Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 211KB
  • Sample221101-bds28sffep
  • SHA256 fe766b72dca4eae0eacff52b19784b324362ace8e390b6105c3df577a0a7af8d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
djvuredlinesmokeloadermario23_10backdoorcollectiondiscoveryinfostealerpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • djvu

C2

  • http://fresherlights.com/lancer/get.php

Attributes
  • extension

    .bozq

  • offline_id

    oHp5e4SJxdFtxfvKYmeX06F4C5cn0EcsF5Ak9Wt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://fresherlights.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-dyi5UcwIT9 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0597Jhyjd

rsa_pubkey.plain

Extracted

Family

  • redline

Botnet

  • mario23_10

C2

  • 167.235.252.160:10642

Attributes
  • auth_value

    eca57cfb5172f71dc45986763bb98942

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 20 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 20 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3524
  • C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\C112.dll
    1⤵
    • Loads dropped DLL
    PID:3208
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\C112.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
  • C:\Users\Admin\AppData\Local\Temp\C1DF.exe
    C:\Users\Admin\AppData\Local\Temp\C1DF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1264
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1256
      2⤵
      • Program crash
      PID:3968
  • C:\Users\Admin\AppData\Local\Temp\C3B4.exe
    C:\Users\Admin\AppData\Local\Temp\C3B4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\C3B4.exe
      C:\Users\Admin\AppData\Local\Temp\C3B4.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2876
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\7065f746-61d8-4634-82d7-f3aeee7669a0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4108
      • C:\Users\Admin\AppData\Local\Temp\C3B4.exe
        "C:\Users\Admin\AppData\Local\Temp\C3B4.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Users\Admin\AppData\Local\Temp\C3B4.exe
          "C:\Users\Admin\AppData\Local\Temp\C3B4.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:5084
          • C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe
            "C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3908
            • C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe
              "C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe"
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Checks processor information in registry
              PID:2424
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe" & exit
                7⤵
                  PID:4204
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    8⤵
                    • Delays execution with timeout.exe
                    PID:4852
            • C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build3.exe
              "C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build3.exe"
              5⤵
              • Executes dropped EXE
              PID:2400
    • C:\Users\Admin\AppData\Local\Temp\CA6C.exe
      C:\Users\Admin\AppData\Local\Temp\CA6C.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3332
    • C:\Users\Admin\AppData\Local\Temp\CDA9.exe
      C:\Users\Admin\AppData\Local\Temp\CDA9.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1364
    • C:\Users\Admin\AppData\Local\Temp\CF6F.exe
      C:\Users\Admin\AppData\Local\Temp\CF6F.exe
      1⤵
      • Executes dropped EXE
      PID:3512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 340
        2⤵
        • Program crash
        PID:4372
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:3472
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:2744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3512 -ip 3512
        1⤵
          PID:1664
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          1⤵
          • Creates scheduled task(s)
          PID:884
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1264 -ip 1264
          1⤵
            PID:2236
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            1⤵
            • Executes dropped EXE
            PID:4376
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              2⤵
              • Creates scheduled task(s)
              PID:1432
          • C:\Users\Admin\AppData\Local\Temp\389A.exe
            C:\Users\Admin\AppData\Local\Temp\389A.exe
            1⤵
            • Executes dropped EXE
            • Checks computer location settings
            PID:396
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 636
              2⤵
              • Program crash
              PID:2200
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 924
              2⤵
              • Program crash
              PID:480
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 932
              2⤵
              • Program crash
              PID:3212
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1104
              2⤵
              • Program crash
              PID:220
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1124
              2⤵
              • Program crash
              PID:4580
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1124
              2⤵
              • Program crash
              PID:1448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1176
              2⤵
              • Program crash
              PID:2736
            • C:\Users\Admin\AppData\Local\Temp\389A.exe
              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
              2⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:2204
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 600
                3⤵
                • Program crash
                PID:2572
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1000
                3⤵
                • Program crash
                PID:1372
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1004
                3⤵
                • Program crash
                PID:4692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1000
                3⤵
                • Program crash
                PID:3880
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1100
                3⤵
                • Program crash
                PID:4872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1124
                3⤵
                • Program crash
                PID:3980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1128
                3⤵
                • Program crash
                PID:4196
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1076
                3⤵
                • Program crash
                PID:4400
              • C:\Users\Admin\AppData\Local\Temp\389A.exe
                "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                3⤵
                • Executes dropped EXE
                • Checks computer location settings
                PID:4188
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 600
                  4⤵
                  • Program crash
                  PID:4240
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 996
                  4⤵
                  • Program crash
                  PID:3920
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1004
                  4⤵
                  • Program crash
                  PID:2400
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1004
                  4⤵
                  • Program crash
                  PID:4756
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1004
                  4⤵
                  • Program crash
                  PID:4348
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1076
                  4⤵
                  • Program crash
                  PID:5104
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1132
                  4⤵
                  • Program crash
                  PID:4308
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1188
                  4⤵
                  • Program crash
                  PID:4236
                • C:\Users\Admin\AppData\Local\Temp\389A.exe
                  "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  PID:4408
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 600
                    5⤵
                    • Program crash
                    PID:2220
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 976
                    5⤵
                    • Program crash
                    PID:1524
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 984
                    5⤵
                    • Program crash
                    PID:4272
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 984
                    5⤵
                    • Program crash
                    PID:2520
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1108
                    5⤵
                    • Program crash
                    PID:1580
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1096
                    5⤵
                    • Program crash
                    PID:4692
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1124
                    5⤵
                    • Program crash
                    PID:3412
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1112
                    5⤵
                    • Program crash
                    PID:380
                  • C:\Users\Admin\AppData\Local\Temp\389A.exe
                    "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                    5⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    PID:424
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 600
                      6⤵
                      • Program crash
                      PID:4492
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 996
                      6⤵
                      • Program crash
                      PID:4320
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1064
                      6⤵
                      • Program crash
                      PID:2020
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1064
                      6⤵
                      • Program crash
                      PID:1812
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1084
                      6⤵
                      • Program crash
                      PID:2936
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1112
                      6⤵
                      • Program crash
                      PID:396
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 1004
                      6⤵
                      • Program crash
                      PID:3020
                    • C:\Users\Admin\AppData\Local\Temp\389A.exe
                      "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                      6⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      PID:4708
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 600
                        7⤵
                        • Program crash
                        PID:4852
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 980
                        7⤵
                        • Program crash
                        PID:4540
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1064
                        7⤵
                        • Program crash
                        PID:2200
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1064
                        7⤵
                        • Program crash
                        PID:4316
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1112
                        7⤵
                        • Program crash
                        PID:4652
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1064
                        7⤵
                        • Program crash
                        PID:2220
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1088
                        7⤵
                        • Program crash
                        PID:1352
                      • C:\Users\Admin\AppData\Local\Temp\389A.exe
                        "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                        7⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        PID:5040
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 600
                          8⤵
                          • Program crash
                          PID:1984
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 996
                          8⤵
                          • Program crash
                          PID:3468
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1004
                          8⤵
                          • Program crash
                          PID:3412
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1076
                          8⤵
                          • Program crash
                          PID:380
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1004
                          8⤵
                          • Program crash
                          PID:4180
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1112
                          8⤵
                            PID:1508
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1128
                            8⤵
                              PID:64
                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                              8⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              PID:4896
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 600
                                9⤵
                                  PID:3984
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 884
                                  9⤵
                                    PID:2936
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 884
                                    9⤵
                                      PID:440
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 888
                                      9⤵
                                        PID:4300
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1080
                                        9⤵
                                          PID:4336
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1092
                                          9⤵
                                            PID:4532
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1104
                                            9⤵
                                              PID:768
                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                              9⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              PID:4292
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 600
                                                10⤵
                                                  PID:3900
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 996
                                                  10⤵
                                                    PID:2220
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1064
                                                    10⤵
                                                      PID:4916
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1064
                                                      10⤵
                                                        PID:1388
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1112
                                                        10⤵
                                                          PID:4704
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1144
                                                          10⤵
                                                            PID:1580
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1152
                                                            10⤵
                                                              PID:3492
                                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                              10⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              PID:3468
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 600
                                                                11⤵
                                                                  PID:3332
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 996
                                                                  11⤵
                                                                    PID:2172
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1004
                                                                    11⤵
                                                                      PID:4320
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1060
                                                                      11⤵
                                                                        PID:3760
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1068
                                                                        11⤵
                                                                          PID:1264
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1140
                                                                          11⤵
                                                                            PID:396
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1148
                                                                            11⤵
                                                                              PID:2984
                                                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                              11⤵
                                                                              • Executes dropped EXE
                                                                              • Checks computer location settings
                                                                              PID:1500
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 600
                                                                                12⤵
                                                                                  PID:1412
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 900
                                                                                  12⤵
                                                                                    PID:2200
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 900
                                                                                    12⤵
                                                                                      PID:2204
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1076
                                                                                      12⤵
                                                                                        PID:4912
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1108
                                                                                        12⤵
                                                                                          PID:4268
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1108
                                                                                          12⤵
                                                                                            PID:628
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1136
                                                                                            12⤵
                                                                                              PID:4132
                                                                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                                              12⤵
                                                                                              • Executes dropped EXE
                                                                                              • Checks computer location settings
                                                                                              PID:2068
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 600
                                                                                                13⤵
                                                                                                  PID:3612
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1016
                                                                                                  13⤵
                                                                                                    PID:1448
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1080
                                                                                                    13⤵
                                                                                                      PID:4368
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1080
                                                                                                      13⤵
                                                                                                        PID:3652
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1104
                                                                                                        13⤵
                                                                                                          PID:2236
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 624
                                                                                                          13⤵
                                                                                                            PID:392
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1128
                                                                                                            13⤵
                                                                                                              PID:4808
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                                                              13⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:3808
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 600
                                                                                                                14⤵
                                                                                                                  PID:4084
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1044
                                                                                                                  14⤵
                                                                                                                    PID:3900
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1052
                                                                                                                    14⤵
                                                                                                                      PID:4428
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1052
                                                                                                                      14⤵
                                                                                                                        PID:4916
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1084
                                                                                                                        14⤵
                                                                                                                          PID:1608
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1072
                                                                                                                          14⤵
                                                                                                                            PID:4708
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1136
                                                                                                                            14⤵
                                                                                                                              PID:3880
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                                                                              14⤵
                                                                                                                                PID:3448
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 532
                                                                                                                                  15⤵
                                                                                                                                    PID:4828
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 996
                                                                                                                                    15⤵
                                                                                                                                      PID:768
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1088
                                                                                                                                      15⤵
                                                                                                                                        PID:5032
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1120
                                                                                                                                        15⤵
                                                                                                                                          PID:4144
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1000
                                                                                                                                          15⤵
                                                                                                                                            PID:2736
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1128
                                                                                                                                            15⤵
                                                                                                                                              PID:2980
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1136
                                                                                                                                              15⤵
                                                                                                                                                PID:628
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                                                                                                15⤵
                                                                                                                                                  PID:4752
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 600
                                                                                                                                                    16⤵
                                                                                                                                                      PID:4112
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 996
                                                                                                                                                      16⤵
                                                                                                                                                        PID:5044
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1004
                                                                                                                                                        16⤵
                                                                                                                                                          PID:520
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1068
                                                                                                                                                          16⤵
                                                                                                                                                            PID:4972
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1076
                                                                                                                                                            16⤵
                                                                                                                                                              PID:1836
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1104
                                                                                                                                                              16⤵
                                                                                                                                                                PID:2132
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1128
                                                                                                                                                                16⤵
                                                                                                                                                                  PID:4180
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1068
                                                                                                                                                                  16⤵
                                                                                                                                                                    PID:696
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\389A.exe"
                                                                                                                                                                    16⤵
                                                                                                                                                                      PID:3388
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 600
                                                                                                                                                                        17⤵
                                                                                                                                                                          PID:440
                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                        16⤵
                                                                                                                                                                          PID:3160
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 984
                                                                                                                                                                          16⤵
                                                                                                                                                                            PID:2740
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1244
                                                                                                                                                                            16⤵
                                                                                                                                                                              PID:4912
                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                            C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                            15⤵
                                                                                                                                                                              PID:848
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 984
                                                                                                                                                                              15⤵
                                                                                                                                                                                PID:944
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1092
                                                                                                                                                                                15⤵
                                                                                                                                                                                  PID:3452
                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                14⤵
                                                                                                                                                                                  PID:1944
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 984
                                                                                                                                                                                  14⤵
                                                                                                                                                                                    PID:4364
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 1144
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:3756
                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                    13⤵
                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                    PID:3020
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1004
                                                                                                                                                                                    13⤵
                                                                                                                                                                                      PID:3788
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1272
                                                                                                                                                                                      13⤵
                                                                                                                                                                                        PID:2580
                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                      12⤵
                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      PID:1984
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 932
                                                                                                                                                                                      12⤵
                                                                                                                                                                                        PID:2584
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 904
                                                                                                                                                                                        12⤵
                                                                                                                                                                                          PID:4872
                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                        11⤵
                                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:948
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 984
                                                                                                                                                                                        11⤵
                                                                                                                                                                                          PID:4336
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 1108
                                                                                                                                                                                          11⤵
                                                                                                                                                                                            PID:3176
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                          10⤵
                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:3064
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 984
                                                                                                                                                                                          10⤵
                                                                                                                                                                                            PID:816
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1208
                                                                                                                                                                                            10⤵
                                                                                                                                                                                              PID:4780
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:4392
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1016
                                                                                                                                                                                            9⤵
                                                                                                                                                                                              PID:2196
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1156
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:2200
                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                              C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:3724
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 984
                                                                                                                                                                                              8⤵
                                                                                                                                                                                                PID:1300
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 1324
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Blocklisted process makes network request
                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                PID:3268
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1004
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:4312
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 1140
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                PID:4796
                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                              C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              PID:4740
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 984
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:4348
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 992
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Program crash
                                                                                                                                                                                              PID:3648
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            PID:400
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1004
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:4180
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1132
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:2008
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                          PID:2092
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 984
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          PID:3688
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1192
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Program crash
                                                                                                                                                                                          PID:1136
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 988
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Program crash
                                                                                                                                                                                        PID:4492
                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                        C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        PID:4004
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1004
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Program crash
                                                                                                                                                                                        PID:5032
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1048
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:4124
                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                      C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll,start
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                      PID:3616
                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 14029
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4544
                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                          schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:732
                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                            schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1104
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 1156
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:1536
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 396 -ip 396
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2764
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 396 -ip 396
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3916
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 396 -ip 396
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3432
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 396 -ip 396
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2808
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 396 -ip 396
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:872
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 396 -ip 396
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 396 -ip 396
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:228
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 396 -ip 396
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4312
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2204 -ip 2204
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2416
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 2204
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2204 -ip 2204
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4156
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2204 -ip 2204
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 2204
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2204 -ip 2204
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:424
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 2204
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3196
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2204 -ip 2204
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2204 -ip 2204
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:2548
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4188 -ip 4188
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4188 -ip 4188
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4188 -ip 4188
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4304
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4188 -ip 4188
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3760
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 396 -ip 396
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4188 -ip 4188
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4188 -ip 4188
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2232
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4188 -ip 4188
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4188 -ip 4188
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4188 -ip 4188
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:2196
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2204 -ip 2204
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4188 -ip 4188
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4408 -ip 4408
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4408 -ip 4408
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4408 -ip 4408
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4408 -ip 4408
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4408 -ip 4408
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:224
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4408 -ip 4408
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:1404
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4408 -ip 4408
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4296
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4408 -ip 4408
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:3064
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4408 -ip 4408
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4408 -ip 4408
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 424 -ip 424
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:3748
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 424 -ip 424
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 424 -ip 424
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 424 -ip 424
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2544
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 424 -ip 424
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:2076
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 424 -ip 424
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5044
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 424 -ip 424
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:3808
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 424 -ip 424
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 424 -ip 424
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:3824
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:4840
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:1976
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:3900
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:4268
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4708 -ip 4708
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4752
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:2580
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:444
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4196
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:3332
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5040 -ip 5040
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:3936
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:2756
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4896 -ip 4896
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:4760
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4104
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2352
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2980
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1804
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:372
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4284
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4292 -ip 4292
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4492
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3652
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:520
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3392
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:932
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3468 -ip 3468
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2368
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3832
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4724
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1500 -ip 1500
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2068 -ip 2068
                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 3808 -ip 3808
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3448 -ip 3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4752 -ip 4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3388 -ip 3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3508

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\mozglue.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 593KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\nss3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sqlite3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\sqlite3.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 b14043ac188588e6e6282e515cc581ca0aaae5fbf84a0cf087204bae7fcdad55
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 35188ecd41bd046f9f71e26f5404d5406be5e20bf8f2b6963adaec084783bef5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 488B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d3141611c2aa46cb4156a86946d20552d5206007e8f158da95729c3e38c5fc93
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 482B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 109826446f2489afa9df5224cb3a16db7a9e2f85bb1a81712ab6f4ccf57169fd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 323KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1aacaadce5954ff321f06df9cf1785902ef0b1806599b8b0aa477ae211ff2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 323KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1aacaadce5954ff321f06df9cf1785902ef0b1806599b8b0aa477ae211ff2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 323KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1aacaadce5954ff321f06df9cf1785902ef0b1806599b8b0aa477ae211ff2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\33728470-0451-4b43-9c30-63655fcfac5d\build3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\7065f746-61d8-4634-82d7-f3aeee7669a0\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\389A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 6.1MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 1d7d891d56b2eb848a7ed15272197aeabb0235e5dfb89a74b93d19e45eb82f89
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        684259a6-0175-4108-a860-699cb31f63c2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\684259a6-0175-4108-a860-699cb31f63c2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 ee80340a02c0f96a3f9d01e635857d38d7b92444d6102ee29804f559f2eaa7f4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C112.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C112.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e485f007bfade595ea3b13742c1bf0da4f074edaaa65d8cf807796a18317b4f6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C112.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C112.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 1.5MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 e485f007bfade595ea3b13742c1bf0da4f074edaaa65d8cf807796a18317b4f6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C1DF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C1DF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 340KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 173d9fb69de0939d3266706ce44baf55669abdf1ca35b91236d84e1f4306f844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C1DF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C1DF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 340KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 173d9fb69de0939d3266706ce44baf55669abdf1ca35b91236d84e1f4306f844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\C3B4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 728KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8650ba0e8dcaae7c1db4f083f4039a51f9432737ae89fe3e454bb619e3ae108b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CA6C.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CA6C.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f1923024464e9c4629ce3606dfbc4dc64f60b66625e428807fcde56cb06e5e29
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CA6C.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CA6C.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 f1923024464e9c4629ce3606dfbc4dc64f60b66625e428807fcde56cb06e5e29
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CDA9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CDA9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 210KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0161745ee2070cf734741f33d01f338ec3b0a65ef59169b7bccab53cd4973e4b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CDA9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CDA9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 210KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 0161745ee2070cf734741f33d01f338ec3b0a65ef59169b7bccab53cd4973e4b
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CF6F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CF6F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 209KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d5241af9dd7e7fe48fc043b520f3366a806269d869d9add684bcb37d2582b1ad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        CF6F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\CF6F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 209KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 d5241af9dd7e7fe48fc043b520f3366a806269d869d9add684bcb37d2582b1ad
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Dydhshsoe.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 cf844eaff5de04653c1b05da88554242ee669501f7f2147658e57f73fd1fb3d1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        msedge_installer.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\msedge_installer.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 7bc05c175a0201ec193933f45c3a16ae8f4b9d959ef9f8253ebd6d0d7579d569
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wct399A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\wct399A.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 62KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 094754a618b102b7ad0800dd4c9c02c882cf2d1e7996ba864f422fa4312427e1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/396-250-0x0000000002F30000-0x0000000003550000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/396-251-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/396-249-0x000000000293E000-0x0000000002F28000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/396-258-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/396-266-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/848-414-0x0000000003030000-0x0000000003B8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/848-413-0x0000000003030000-0x0000000003B8F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-216-0x000000000073D000-0x000000000076E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-147-0x00000000021C0000-0x00000000021FE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-221-0x00000000076A0000-0x0000000007BCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-217-0x00000000074D0000-0x0000000007692000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-170-0x0000000005430000-0x000000000546C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-164-0x00000000052E0000-0x00000000053EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-214-0x0000000007400000-0x0000000007476000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-215-0x0000000007480000-0x00000000074D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-212-0x0000000005D50000-0x0000000005DB6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-167-0x0000000005410000-0x0000000005422000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-162-0x00000000054C0000-0x0000000005AD8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-150-0x0000000004C00000-0x0000000004C92000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-149-0x0000000004D10000-0x00000000052B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-148-0x0000000000400000-0x00000000005B8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-146-0x000000000073D000-0x000000000076E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-235-0x0000000000400000-0x00000000005B8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1264-234-0x000000000073D000-0x000000000076E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1364-187-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1364-186-0x00000000006F0000-0x00000000006F9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1364-213-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1364-184-0x000000000073D000-0x000000000074D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1708-156-0x00000000022DB000-0x000000000236C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1708-157-0x0000000002370000-0x000000000248B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1944-400-0x00000000029B0000-0x000000000350F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1944-398-0x00000000029B0000-0x000000000350F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/1944-394-0x00000000020C0000-0x000000000240D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2092-275-0x0000000000400000-0x000000000074D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2204-261-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2204-254-0x00000000028DD000-0x0000000002EC7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2204-276-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2204-255-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2424-229-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2424-241-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2424-223-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2424-225-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2424-228-0x0000000000400000-0x000000000046E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2744-185-0x0000000000F00000-0x0000000000F0C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2876-195-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2876-158-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2876-171-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2876-154-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/2876-152-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3020-377-0x0000000002CF0000-0x000000000384F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3020-376-0x0000000002CF0000-0x000000000384F000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3064-337-0x00000000020B0000-0x00000000023FD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3208-166-0x0000000003200000-0x0000000003320000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3208-169-0x0000000003440000-0x0000000003560000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3208-200-0x0000000003440000-0x0000000003560000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3208-196-0x0000000003570000-0x000000000363B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3208-197-0x0000000003650000-0x0000000003708000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3268-306-0x0000000001EA0000-0x00000000021ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3332-163-0x0000000000400000-0x0000000000460000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3472-190-0x0000000001010000-0x000000000107B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3472-183-0x0000000001010000-0x000000000107B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3472-182-0x0000000001080000-0x00000000010F5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3512-192-0x000000000071D000-0x000000000072D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3512-188-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3524-133-0x00000000006E0000-0x00000000006E9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3524-134-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3524-135-0x0000000000400000-0x0000000000598000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3524-132-0x00000000008CD000-0x00000000008DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-383-0x00000000040B0000-0x00000000041F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-367-0x00000000040B0000-0x00000000041F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-380-0x0000000004A60000-0x0000000004BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-382-0x00000000040B0000-0x00000000041F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-368-0x00000000040B0000-0x00000000041F0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-381-0x0000000004A60000-0x0000000004BA0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-364-0x0000000003450000-0x0000000003FAF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-265-0x0000000000400000-0x000000000074D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-361-0x0000000003450000-0x0000000003FAF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3616-280-0x0000000000400000-0x000000000074D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3908-227-0x0000000002120000-0x0000000002179000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/3908-226-0x0000000000668000-0x0000000000695000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4004-274-0x0000000000400000-0x000000000074D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4048-205-0x000000000218D000-0x000000000221E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4188-273-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4188-260-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4188-279-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4188-259-0x0000000002926000-0x0000000002F10000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4392-326-0x0000000002570000-0x00000000028BD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4408-278-0x0000000000400000-0x0000000000B72000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4408-277-0x0000000002984000-0x0000000002F6E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4544-385-0x00000297F7630000-0x00000297F7770000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4544-387-0x00000297F7630000-0x00000297F7770000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/4740-296-0x00000000024F0000-0x000000000283D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5084-204-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5084-239-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5084-211-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        memory/5084-206-0x0000000000400000-0x0000000000537000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Download