b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99

Analysis

max time kernel
117s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe
Size

193KB
MD5

02a7a652fee96247813573bf0b2feaec
SHA1

ccf14d62043b4f8ca75a5c78f9252c6b5e7883f5
SHA256

b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99
SHA512

ce7eb448e77196fd633017d7257cde6f97ae493dc02ba3b2de1ab08c02dbc3f51f81c0a88f3fc5290157bfb75ba85f232fc461625a3af471874e4a019d9155e8
SSDEEP

3072:99yAofxov3uxWyDTBHKt3jcS8OvbS2ih6FH7sGndT5STyXftHd/y:6PZxWe9I3jcS82uB6FHJndvVd

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe

Loads dropped DLL 64 IoCs

pid	Process
2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe
1448	WerFault.exe
2952	WerFault.exe
548	WerFault.exe
4356	WerFault.exe
3876	WerFault.exe
4264	WerFault.exe
3528	WerFault.exe
3848	WerFault.exe
3532	WerFault.exe
3196	WerFault.exe
1692	WerFault.exe
4592	WerFault.exe
5052	WerFault.exe
1912	WerFault.exe
4152	WerFault.exe
5056	WerFault.exe
1204	WerFault.exe
2976	WerFault.exe
4948	WerFault.exe
1812	WerFault.exe
864	WerFault.exe
3236	WerFault.exe
2768	WerFault.exe
4092	WerFault.exe
2596	WerFault.exe
1908	WerFault.exe
2236	WerFault.exe
4724	WerFault.exe
1000	WerFault.exe
3860	WerFault.exe
4292	WerFault.exe
4216	WerFault.exe
4588	WerFault.exe
4024	WerFault.exe
3652	WerFault.exe
2152	WerFault.exe
4932	WerFault.exe
1044	WerFault.exe
4540	WerFault.exe
636	WerFault.exe
4276	WerFault.exe
2676	WerFault.exe
1172	WerFault.exe
4240	WerFault.exe
2560	WerFault.exe
2164	WerFault.exe
1960	WerFault.exe
1360	WerFault.exe
2428	WerFault.exe
4304	WerFault.exe
4156	WerFault.exe
900	WerFault.exe
3240	WerFault.exe
4080	WerFault.exe
4564	WerFault.exe
1264	WerFault.exe
2828	WerFault.exe
3160	WerFault.exe
1684	WerFault.exe
4460	WerFault.exe
812	WerFault.exe
4560	WerFault.exe
452	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3740	4560	WerFault.exe	150
4184	2436	WerFault.exe	83
2560	2436	WerFault.exe	83
2372	2436	WerFault.exe	83

Runs .reg file with regedit 1 IoCs

pid	Process
812	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe
2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 3716	2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe	84
PID 2436 wrote to memory of 3716	2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe	84
PID 2436 wrote to memory of 3716	2436	b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe	84
PID 3716 wrote to memory of 812	3716	regedt32.exe	85
PID 3716 wrote to memory of 812	3716	regedt32.exe	85
PID 3716 wrote to memory of 812	3716	regedt32.exe	85

C:\Users\Admin\AppData\Local\Temp\b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe
"C:\Users\Admin\AppData\Local\Temp\b383851804d8ded9ca6210a28455e6ceadb01685ebf915c6a5468ffcd1b9de99.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\regedt32.exe
  "C:\Windows\System32\regedt32.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\regedit.exe" /s "C:\Users\Admin\Documents\Iterra\T03emp03.reg"
    3⤵
    - Runs .reg file with regedit
    PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 880
  2⤵
  - Program crash
  PID:4184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 576
  2⤵
  - Program crash
  PID:2560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1028
  2⤵
  - Program crash
  PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2436 -ip 2436
1⤵
- Loads dropped DLL
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1448 -ip 1448
1⤵
- Loads dropped DLL
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2952 -ip 2952
1⤵
- Loads dropped DLL
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 548 -ip 548
1⤵
- Loads dropped DLL
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4356 -ip 4356
1⤵
- Loads dropped DLL
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2436 -ip 2436
1⤵
- Loads dropped DLL
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3876 -ip 3876
1⤵
- Loads dropped DLL
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4264 -ip 4264
1⤵
- Loads dropped DLL
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3528 -ip 3528
1⤵
- Loads dropped DLL
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3848 -ip 3848
1⤵
- Loads dropped DLL
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3532 -ip 3532
1⤵
- Loads dropped DLL
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3196 -ip 3196
1⤵
- Loads dropped DLL
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1692 -ip 1692
1⤵
- Loads dropped DLL
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4592 -ip 4592
1⤵
- Loads dropped DLL
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5052 -ip 5052
1⤵
- Loads dropped DLL
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1912 -ip 1912
1⤵
- Loads dropped DLL
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4152 -ip 4152
1⤵
- Loads dropped DLL
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5056 -ip 5056
1⤵
- Loads dropped DLL
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1204 -ip 1204
1⤵
- Loads dropped DLL
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2976 -ip 2976
1⤵
- Loads dropped DLL
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4948 -ip 4948
1⤵
- Loads dropped DLL
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 1812 -ip 1812
1⤵
- Loads dropped DLL
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 864 -ip 864
1⤵
- Loads dropped DLL
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2768 -ip 2768
1⤵
- Loads dropped DLL
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3236 -ip 3236
1⤵
- Loads dropped DLL
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 2596 -ip 2596
1⤵
- Loads dropped DLL
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 1908 -ip 1908
1⤵
- Loads dropped DLL
PID:4724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 2236 -ip 2236
1⤵
- Loads dropped DLL
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4724 -ip 4724
1⤵
- Loads dropped DLL
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 1000 -ip 1000
1⤵
- Loads dropped DLL
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3860 -ip 3860
1⤵
- Loads dropped DLL
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4292 -ip 4292
1⤵
- Loads dropped DLL
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 4092 -ip 4092
1⤵
- Loads dropped DLL
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 4588 -ip 4588
1⤵
- Loads dropped DLL
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 4216 -ip 4216
1⤵
- Loads dropped DLL
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4024 -ip 4024
1⤵
- Loads dropped DLL
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1028 -p 3652 -ip 3652
1⤵
- Loads dropped DLL
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 2152 -ip 2152
1⤵
- Loads dropped DLL
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 4932 -ip 4932
1⤵
- Loads dropped DLL
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 1044 -ip 1044
1⤵
- Loads dropped DLL
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 4540 -ip 4540
1⤵
- Loads dropped DLL
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1128 -p 636 -ip 636
1⤵
- Loads dropped DLL
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 4276 -ip 4276
1⤵
- Loads dropped DLL
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 2676 -ip 2676
1⤵
- Loads dropped DLL
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 4240 -ip 4240
1⤵
- Loads dropped DLL
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1164 -p 1172 -ip 1172
1⤵
- Loads dropped DLL
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1184 -p 2560 -ip 2560
1⤵
- Loads dropped DLL
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 2164 -ip 2164
1⤵
- Loads dropped DLL
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 1360 -ip 1360
1⤵
- Loads dropped DLL
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 2428 -ip 2428
1⤵
- Loads dropped DLL
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 4304 -ip 4304
1⤵
- Loads dropped DLL
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 1960 -ip 1960
1⤵
- Loads dropped DLL
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 900 -ip 900
1⤵
- Loads dropped DLL
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 4156 -ip 4156
1⤵
- Loads dropped DLL
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1268 -p 3240 -ip 3240
1⤵
- Loads dropped DLL
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1328 -p 4080 -ip 4080
1⤵
- Loads dropped DLL
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 4564 -ip 4564
1⤵
- Loads dropped DLL
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 2828 -ip 2828
1⤵
- Loads dropped DLL
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1400 -p 3160 -ip 3160
1⤵
- Loads dropped DLL
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1420 -p 1684 -ip 1684
1⤵
- Loads dropped DLL
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1428 -p 4460 -ip 4460
1⤵
- Loads dropped DLL
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1372 -p 1264 -ip 1264
1⤵
- Loads dropped DLL
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1432 -p 812 -ip 812
1⤵
- Loads dropped DLL
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 500
  2⤵
  - Program crash
  PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1452 -p 4560 -ip 4560
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1460 -p 3740 -ip 3740
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1464 -p 2840 -ip 2840
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1520 -p 2240 -ip 2240
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1376 -p 1732 -ip 1732
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1332 -p 4412 -ip 4412
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 4184 -ip 4184
1⤵
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2272 -ip 2272
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1004 -ip 1004
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2632 -ip 2632
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4636 -ip 4636
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1056 -p 4320 -ip 4320
1⤵
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3968 -ip 3968
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 2100 -ip 2100
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4460 -ip 4460
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1256 -p 2416 -ip 2416
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 4516 -ip 4516
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4944 -ip 4944
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 2696 -ip 2696
1⤵
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 732 -ip 732
1⤵
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4804 -ip 4804
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3544 -ip 3544
1⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 1420 -ip 1420
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4412 -ip 4412
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 1360 -ip 1360
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1364 -p 5088 -ip 5088
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1572 -ip 1572
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 2560 -ip 2560
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1212 -ip 1212
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4392 -ip 4392
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 364 -ip 364
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2844 -ip 2844
1⤵
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1064 -ip 1064
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1028 -ip 1028
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2660 -ip 2660
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4560 -ip 4560
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 1800 -ip 1800
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 1684 -ip 1684
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 2828 -ip 2828
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2924 -ip 2924
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 4564 -ip 4564
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4504 -ip 4504
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4344 -ip 4344
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 4068 -ip 4068
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 3588 -ip 3588
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 3500 -ip 3500
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1520 -p 3480 -ip 3480
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1240 -p 4304 -ip 4304
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 4092 -ip 4092
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 2116 -ip 2116
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3236 -ip 3236
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 3208 -ip 3208
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 1328 -ip 1328
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4372 -ip 4372
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 3360 -ip 3360
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4152 -ip 4152
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3856 -ip 3856
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4532 -ip 4532
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3752 -ip 3752
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1288 -p 3720 -ip 3720
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 2884 -ip 2884
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3700 -ip 3700
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 1820 -ip 1820
1⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1356 -p 2736 -ip 2736
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1528 -p 3696 -ip 3696
1⤵
PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 1196 -ip 1196
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 2864 -ip 2864
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 4212 -ip 4212
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1408 -p 3456 -ip 3456
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2436 -ip 2436
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1332 -ip 1332
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 3116 -ip 3116
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 2644 -ip 2644
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5096 -ip 5096
1⤵
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1196 -ip 1196
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4588 -ip 4588
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4540 -ip 4540
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 1392 -ip 1392
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3736 -ip 3736
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3528 -ip 3528
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3568 -ip 3568
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2820 -ip 2820
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1172 -ip 1172
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3752 -ip 3752
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5080 -ip 5080
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3360 -ip 3360
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1136 -p 1204 -ip 1204
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 2164 -ip 2164
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4176 -ip 4176
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 864 -ip 864
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5036 -ip 5036
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3236 -ip 3236
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3500 -ip 3500
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4380 -ip 4380
1⤵
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1144 -p 3240 -ip 3240
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1300 -p 4448 -ip 4448
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1236 -p 5084 -ip 5084
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3588 -ip 3588
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 2924 -ip 2924
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1424 -p 3868 -ip 3868
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1208 -p 4216 -ip 4216
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4024 -ip 4024
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5040 -ip 5040
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2096 -ip 2096
1⤵
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 812 -ip 812
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2668 -ip 2668
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3976 -ip 3976
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1064 -ip 1064
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 1512 -ip 1512
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2240 -ip 2240
1⤵
PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1492 -p 2676 -ip 2676
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5088 -ip 5088
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1412 -p 4412 -ip 4412
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3628 -ip 3628
1⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 1420 -ip 1420
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4312 -ip 4312
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 4928 -ip 4928
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4944 -ip 4944
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 1840 -ip 1840
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 1896 -ip 1896
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4516 -ip 4516
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 2100 -ip 2100
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4052 -ip 4052
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1228 -p 4636 -ip 4636
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4840 -ip 4840
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 1240 -ip 1240
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2632 -ip 2632
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4832 -ip 4832
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1284 -p 2976 -ip 2976
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 2180 -ip 2180
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 3616 -ip 3616
1⤵
PID:376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1376 -p 376 -ip 376
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1540 -p 4192 -ip 4192
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1172 -p 2372 -ip 2372
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4232 -ip 4232
1⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4780 -ip 4780
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 4872 -ip 4872
1⤵
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1200 -p 744 -ip 744
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1724 -ip 1724
1⤵
PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1152 -p 780 -ip 780
1⤵
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1176 -p 1280 -ip 1280
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1476 -p 4224 -ip 4224
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 5004 -ip 5004
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1496 -p 3616 -ip 3616
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1168 -p 4908 -ip 4908
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4924 -ip 4924
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3792 -ip 3792
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1220 -p 856 -ip 856
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2632 -ip 2632
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4612 -ip 4612
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1772 -ip 1772
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 4840 -ip 4840
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1492 -p 2320 -ip 2320
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1192 -p 4460 -ip 4460
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3160 -ip 3160
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1532 -p 4480 -ip 4480
1⤵
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1188 -p 4656 -ip 4656
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2460 -ip 2460
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 208 -ip 208
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4652 -ip 4652
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1320 -p 2120 -ip 2120
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4228 -ip 4228
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 1732 -ip 1732
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1280 -p 4424 -ip 4424
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 364 -ip 364
1⤵
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3304 -ip 3304
1⤵
PID:3192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 3192 -ip 3192
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1360 -p 2152 -ip 2152
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 4244 -ip 4244
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1556 -p 1444 -ip 1444
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5040 -ip 5040
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1872 -ip 1872
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1140 -p 5076 -ip 5076
1⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 736 -ip 736
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1308 -p 5060 -ip 5060
1⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3588 -ip 3588
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 4504 -ip 4504
1⤵
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1312 -ip 1312
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4448 -ip 4448
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1384 -p 4092 -ip 4092
1⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1368 -p 3208 -ip 3208
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1148 -p 4576 -ip 4576
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 4168 -ip 4168
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3224 -ip 3224
1⤵
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1204 -p 2116 -ip 2116
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1348 -p 4352 -ip 4352
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 3856 -ip 3856
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1456 -p 4152 -ip 4152
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1260 -p 2876 -ip 2876
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1392 -p 2884 -ip 2884
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1108 -p 3532 -ip 3532
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 4532 -ip 4532
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 1820 -ip 1820
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1440 -ip 1440
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1380 -p 3528 -ip 3528
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1556 -ip 1556
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Iterra\T03emp03.reg

Filesize
217B

MD5
de843232cece98cb20ec6bf07e2009a2

SHA1
3f15e8d5560bc1318cee40c20f3110d8cce3d46f

SHA256
d5d8dc15e1d15eb6f6f5cae65c090a7a316bd799017059b39744790d32ab25ff

SHA512
0b0cc7417fc5eec2527182363c0ded078df3412ca5508140cbfd2d56bedc3c88f2d7c189ece410f72d9b2f687943f71d672613b79c64459773cf10ddd416e304

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
C:\Users\Admin\Documents\Iterra\qvqtvai.dll

Filesize
42KB

MD5
2ab189d22ef09f67f6f97695153d5b8b

SHA1
6c02fa9f9b0d16cd3cbf7e7490650bfec238cdef

SHA256
823ea43243dc7e4533cf2ecde22b851ca6b6f7e730001f809416c5ab09dfd68d

SHA512
56f0a52f6621c38025159b0ebe7b0a2d3d55d68341321cc82a6910eae0173629c813272049789838dcdcf1101a839e12860cb1cc4ecae0213687c4da2d8b048a

Download Submit
memory/2436-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-133-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download