Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 11:55

General

  • Target

    fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe

  • Size

    270KB

  • MD5

    fe793af48ea5f6a280b870e90d3ac04c

  • SHA1

    31ea595d97f612905124203dd1c1d7c5fa902415

  • SHA256

    962a22738f293250720a92b9a81ba199d144f3b6cf646f6e97151696f6e38756

  • SHA512

    cbb213fb49fee2c345a4ba5763c3be3ff53474d864dda2fdd549ffd37d18363a9f33fe62907dd2b5db7de98b02d0b5db31b931d21ce0976e3a9c22ad879b0f17

  • SSDEEP

    6144:eOnRyfNFO0HR7Wu55Onn+VI3zMJ79Wm0fvxT6/eaZ:eI8fNBHlV5I+coJZ+5G/l

Malware Config

Signatures

  • Gh0st RAT payload 14 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 45 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 45 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\ProgramData\en.exe
      "C:\ProgramData\en.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Roaming\install4821093.exe
        C:\Users\Admin\AppData\Roaming\install4821093.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4748
    • C:\ProgramData\qa.exe
      "C:\ProgramData\qa.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Users\Admin\AppData\Roaming\install4903109.exe
        C:\Users\Admin\AppData\Roaming\install4903109.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FE793A~1.EXE >> NUL
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4940
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 592
      2⤵
      • Program crash
      PID:2964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4472 -ip 4472
    1⤵
      PID:2944
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
      1⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1408
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 596
        2⤵
        • Program crash
        PID:2172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1408 -ip 1408
      1⤵
        PID:3300
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
        1⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3212
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 592
          2⤵
          • Program crash
          PID:2984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3212 -ip 3212
        1⤵
          PID:1340
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
          1⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:676
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 592
            2⤵
            • Program crash
            PID:3596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 676 -ip 676
          1⤵
            PID:5048
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
            1⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1996
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 592
              2⤵
              • Program crash
              PID:4436
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1996 -ip 1996
            1⤵
              PID:3648
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
              1⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4856
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 592
                2⤵
                • Program crash
                PID:1988
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4856 -ip 4856
              1⤵
                PID:2344
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
                1⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1076
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 592
                  2⤵
                  • Program crash
                  PID:3464
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1076 -ip 1076
                1⤵
                  PID:3436
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
                  1⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1016
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 596
                    2⤵
                    • Program crash
                    PID:4944
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1016 -ip 1016
                  1⤵
                    PID:1252
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
                    1⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3568
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 592
                      2⤵
                      • Program crash
                      PID:4536
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3568 -ip 3568
                    1⤵
                      PID:3624
                    • C:\Windows\SysWOW64\svchost.exe
                      C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
                      1⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:5084
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 592
                        2⤵
                        • Program crash
                        PID:2892
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5084 -ip 5084
                      1⤵
                        PID:3816
                      • C:\Windows\SysWOW64\svchost.exe
                        C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
                        1⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:4256
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 588
                          2⤵
                          • Program crash
                          PID:4388
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4256 -ip 4256
                        1⤵
                          PID:4300
                        • C:\Windows\SysWOW64\svchost.exe
                          C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
                          1⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1972
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 592
                            2⤵
                            • Program crash
                            PID:4788
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1972 -ip 1972
                          1⤵
                            PID:4620
                          • C:\Windows\SysWOW64\svchost.exe
                            C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
                            1⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:3036
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 592
                              2⤵
                              • Program crash
                              PID:932
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
                            1⤵
                              PID:3852
                            • C:\Windows\SysWOW64\svchost.exe
                              C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
                              1⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:4820
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 584
                                2⤵
                                • Program crash
                                PID:560
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4820 -ip 4820
                              1⤵
                                PID:4560
                              • C:\Windows\SysWOW64\svchost.exe
                                C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
                                1⤵
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:1264
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 592
                                  2⤵
                                  • Program crash
                                  PID:2104
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1264 -ip 1264
                                1⤵
                                  PID:3264
                                • C:\Windows\SysWOW64\svchost.exe
                                  C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
                                  1⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:1712
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 600
                                    2⤵
                                    • Program crash
                                    PID:1452
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1712 -ip 1712
                                  1⤵
                                    PID:3320
                                  • C:\Windows\SysWOW64\svchost.exe
                                    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
                                    1⤵
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:2172
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 592
                                      2⤵
                                      • Program crash
                                      PID:2236
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2172 -ip 2172
                                    1⤵
                                      PID:3224
                                    • C:\Windows\SysWOW64\svchost.exe
                                      C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
                                      1⤵
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:340
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 592
                                        2⤵
                                        • Program crash
                                        PID:5004
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 340 -ip 340
                                      1⤵
                                        PID:220
                                      • C:\Windows\SysWOW64\svchost.exe
                                        C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
                                        1⤵
                                        • Loads dropped DLL
                                        • System Location Discovery: System Language Discovery
                                        PID:3648
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 592
                                          2⤵
                                          • Program crash
                                          PID:3804
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3648 -ip 3648
                                        1⤵
                                          PID:1720
                                        • C:\Windows\SysWOW64\svchost.exe
                                          C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
                                          1⤵
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:2640
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 592
                                            2⤵
                                            • Program crash
                                            PID:1988
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2640 -ip 2640
                                          1⤵
                                            PID:3108
                                          • C:\Windows\SysWOW64\svchost.exe
                                            C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
                                            1⤵
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            PID:4368
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 592
                                              2⤵
                                              • Program crash
                                              PID:1368
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4368 -ip 4368
                                            1⤵
                                              PID:1096
                                            • C:\Windows\SysWOW64\svchost.exe
                                              C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
                                              1⤵
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2788
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 592
                                                2⤵
                                                • Program crash
                                                PID:2904
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2788 -ip 2788
                                              1⤵
                                                PID:3728
                                              • C:\Windows\SysWOW64\svchost.exe
                                                C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
                                                1⤵
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:2244
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 596
                                                  2⤵
                                                  • Program crash
                                                  PID:1280
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2244 -ip 2244
                                                1⤵
                                                  PID:4140
                                                • C:\Windows\SysWOW64\svchost.exe
                                                  C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
                                                  1⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4536
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 592
                                                    2⤵
                                                    • Program crash
                                                    PID:1180
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4536 -ip 4536
                                                  1⤵
                                                    PID:744
                                                  • C:\Windows\SysWOW64\svchost.exe
                                                    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
                                                    1⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4988
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 592
                                                      2⤵
                                                      • Program crash
                                                      PID:1112
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4988 -ip 4988
                                                    1⤵
                                                      PID:2940
                                                    • C:\Windows\SysWOW64\svchost.exe
                                                      C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
                                                      1⤵
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      PID:456
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 592
                                                        2⤵
                                                        • Program crash
                                                        PID:2808
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 456 -ip 456
                                                      1⤵
                                                        PID:4376
                                                      • C:\Windows\SysWOW64\svchost.exe
                                                        C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
                                                        1⤵
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4456
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 592
                                                          2⤵
                                                          • Program crash
                                                          PID:712
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4456 -ip 4456
                                                        1⤵
                                                          PID:5028
                                                        • C:\Windows\SysWOW64\svchost.exe
                                                          C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
                                                          1⤵
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          PID:752
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 596
                                                            2⤵
                                                            • Program crash
                                                            PID:3980
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 752 -ip 752
                                                          1⤵
                                                            PID:4280
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
                                                            1⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1832
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 596
                                                              2⤵
                                                              • Program crash
                                                              PID:3036
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1832 -ip 1832
                                                            1⤵
                                                              PID:3272
                                                            • C:\Windows\SysWOW64\svchost.exe
                                                              C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:4560
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 592
                                                                2⤵
                                                                • Program crash
                                                                PID:1552
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4560 -ip 4560
                                                              1⤵
                                                                PID:1172
                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
                                                                1⤵
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3332
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 592
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:224
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3332 -ip 3332
                                                                1⤵
                                                                  PID:1456
                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                  C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
                                                                  1⤵
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:1544
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 596
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:4112
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1544 -ip 1544
                                                                  1⤵
                                                                    PID:3300
                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
                                                                    1⤵
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:3056
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 596
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:4216
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3056 -ip 3056
                                                                    1⤵
                                                                      PID:4236
                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                      C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
                                                                      1⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1588
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 592
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:340
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1588 -ip 1588
                                                                      1⤵
                                                                        PID:232
                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                        C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
                                                                        1⤵
                                                                        • Loads dropped DLL
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1300
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 592
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:4548
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1300 -ip 1300
                                                                        1⤵
                                                                          PID:3760
                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                          C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
                                                                          1⤵
                                                                          • Loads dropped DLL
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4660
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 592
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:5104
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4660 -ip 4660
                                                                          1⤵
                                                                            PID:3804
                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                            C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
                                                                            1⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4556
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 592
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:4856
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4556 -ip 4556
                                                                            1⤵
                                                                              PID:3460
                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                              C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
                                                                              1⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1368
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 592
                                                                                2⤵
                                                                                • Program crash
                                                                                PID:1252
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1368 -ip 1368
                                                                              1⤵
                                                                                PID:1308
                                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                                C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
                                                                                1⤵
                                                                                • Loads dropped DLL
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4688
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 592
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:468
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4688 -ip 4688
                                                                                1⤵
                                                                                  PID:4372
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry
                                                                                  1⤵
                                                                                    PID:2260
                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                    C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
                                                                                    1⤵
                                                                                    • Loads dropped DLL
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3484
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 544
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:4356
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3484 -ip 3484
                                                                                    1⤵
                                                                                      PID:1728
                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                      C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
                                                                                      1⤵
                                                                                      • Loads dropped DLL
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3748
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 540
                                                                                        2⤵
                                                                                        • Program crash
                                                                                        PID:3000
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3748 -ip 3748
                                                                                      1⤵
                                                                                        PID:4412
                                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                                        C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
                                                                                        1⤵
                                                                                        • Loads dropped DLL
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3312
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 540
                                                                                          2⤵
                                                                                          • Program crash
                                                                                          PID:4300
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3312 -ip 3312
                                                                                        1⤵
                                                                                          PID:5012
                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                          C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
                                                                                          1⤵
                                                                                          • Loads dropped DLL
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4456
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 540
                                                                                            2⤵
                                                                                            • Program crash
                                                                                            PID:2660
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4456 -ip 4456
                                                                                          1⤵
                                                                                            PID:3680
                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                            C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
                                                                                            1⤵
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:384
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 540
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:464
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 384 -ip 384
                                                                                            1⤵
                                                                                              PID:4680
                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                              C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
                                                                                              1⤵
                                                                                              • Loads dropped DLL
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4452
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 540
                                                                                                2⤵
                                                                                                • Program crash
                                                                                                PID:4044
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4452 -ip 4452
                                                                                              1⤵
                                                                                                PID:4512

                                                                                              Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              • C:\ProgramData\en.exe

                                                                                                Filesize

                                                                                                118KB

                                                                                                MD5

                                                                                                2d32fa5e3cb6e967cf3e93d14756c443

                                                                                                SHA1

                                                                                                fc584e983cddc75bd953c6fb47107b503e7c3b13

                                                                                                SHA256

                                                                                                ab74ee4cef9b9d08b9f46cc276047ff490b83588a0ef301e7982aae59663e888

                                                                                                SHA512

                                                                                                c187efea4808cd33d942acac74ac43b35cd336c992e6f277698e1ab60510fd7debc2d2650ffc4952d5715f1d54e6c58130a7ed838afb15fa072d5348e1b32a00

                                                                                              • C:\ProgramData\qa.exe

                                                                                                Filesize

                                                                                                117KB

                                                                                                MD5

                                                                                                6f09bbc6d1e24d76251c0a566ca4310b

                                                                                                SHA1

                                                                                                f38af11d64517fd6e5294e6017e25c016fe0bd7d

                                                                                                SHA256

                                                                                                63bd165b4037893b26af4bf6a29e0dfe6637f0649caddd7196872e5fca2af8c0

                                                                                                SHA512

                                                                                                8eb44d4c7c08cd668b30236193512d1e274922b7b8a1c200af69edba1a83def382c7e2d8b32885fbc658b2ed3c5173fde095f79d39f5209ce51a6168b4f97db0

                                                                                              • C:\Users\Admin\AppData\Roaming\install4821093.exe

                                                                                                Filesize

                                                                                                192KB

                                                                                                MD5

                                                                                                2cdced1cdbb37e687771c7eb297eebc5

                                                                                                SHA1

                                                                                                94ba6b37a5e81090672ed0dc6f4c63dc6b0ee537

                                                                                                SHA256

                                                                                                e008441c0d970ec6a3ac09027b5a32050599339d87ee5392457ce692d2099580

                                                                                                SHA512

                                                                                                330d6ba34633214f5a24e0d18a702121fc87b779ab37f79676f91c09db3be1c158d4e5606dd0529dddc2a822e6d07791a83d72cfbb7e38f8a8b2f38c9ec69def

                                                                                              • C:\Users\Admin\AppData\Roaming\install4903109.exe

                                                                                                Filesize

                                                                                                192KB

                                                                                                MD5

                                                                                                1d3bf95fb92486b71c1c8939ebc27f08

                                                                                                SHA1

                                                                                                008b3fdf0b742b306f50f8503dc5be4b1023a4ca

                                                                                                SHA256

                                                                                                c333f006f231c1dd310d8f97010120cdf710f43fcb555eeec27232f202c2fcf8

                                                                                                SHA512

                                                                                                8f262e10fa53e70f41acb02fcc3208871d9b9ca5e263f3a70aa14aa4b8cb9169e73963740aa3e600e8e4830c67e5c6513721e36decf740f843c8ae8e7b0388e5

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                19.1MB

                                                                                                MD5

                                                                                                ce17b3971d39f6f7d3429b743ed1a29c

                                                                                                SHA1

                                                                                                a996be6afbe0b1f210e966588662c76967d10ad6

                                                                                                SHA256

                                                                                                65f4923f2848089bfbc4f4a55a4d1b8df0fa35952df03a4a07aa246bba7cf002

                                                                                                SHA512

                                                                                                04f24345488ac4900f214749ef92e922820e1b472f0c51cb2e7589073ebdfb03e6527a7311f31482a25578518a9d150bf0cdecd254700e939c387b5214ad2bf8

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                22.0MB

                                                                                                MD5

                                                                                                aeb9b59888ff5f6af810984e5d961ad7

                                                                                                SHA1

                                                                                                6d96db0e0eab7d417a040386ad713fd58c72a124

                                                                                                SHA256

                                                                                                bc1b09f4ae5a1ee44d47fd98e34009d54d1f555d6b584071e6e868db35a29df8

                                                                                                SHA512

                                                                                                76b4d4272d11a9b9388a2bb55b6934c23836b045ed8510f6823f04ab5158827c8c18b7b9c084ab62142fb2351314b3a6c7be587f121e4cbe186dce413f829f59

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                23.0MB

                                                                                                MD5

                                                                                                64ae65f32f5dd89de433d8448d91cc6e

                                                                                                SHA1

                                                                                                9405fbcc1164b1baf09231f13a84469c0c1c4dea

                                                                                                SHA256

                                                                                                2961e8eac39a65bce61ca57ca80e2ae5e9ad794ee1811c59e70451095cb40672

                                                                                                SHA512

                                                                                                cc9d0e2cb51fe0d5b27446bf26b05437893680b664835c6dc35582b262a6cf5d53428f5fab4e3193cfcd8bb2128d3ed850c4c638bfba2575a8b44b2668e756e1

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                23.1MB

                                                                                                MD5

                                                                                                fc14f5c16ecbf26668615f958640bf7d

                                                                                                SHA1

                                                                                                d90f5369ebfa7a48164e62d9e29faea6c6d6f231

                                                                                                SHA256

                                                                                                757f4e3c9b26caf17fc510ca396eb4735b82ff457a26788394480ae9fb78314c

                                                                                                SHA512

                                                                                                4f968d99f482486f9c191eeea0ffef4874aaa794b58f317b7f950b92234a99abf45a61a2e70074310f23cbc07256043d2c05fe88b50b26979cc66aa66df415e7

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                19.1MB

                                                                                                MD5

                                                                                                a317af347509adcb29f13e43a45e8fd3

                                                                                                SHA1

                                                                                                50889df200e550542ef38fd83b6392c4fc08a27f

                                                                                                SHA256

                                                                                                ef6d0ece043eb71e2704b77295f06661e81f3437dddd2147cee50eb88ed22368

                                                                                                SHA512

                                                                                                4e1dd9cd110692dbf4b6881c0707b7378cb07b6019a9cdafd2be219ebfbcdd7f7907b62b5396b8bf2f8364b1e9a7f1bbfedb67aa72b2da4955f652b7cf130256

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                20.1MB

                                                                                                MD5

                                                                                                666da8c17b231ee81ada7a1211436b0e

                                                                                                SHA1

                                                                                                06101c4868b0ef1a1056dc13d42d90bae031d05b

                                                                                                SHA256

                                                                                                e6f167af2b65b07a4b6c7c3fea8f7a3a8e41ae5f6153ff61e13ae92ba2cc12b2

                                                                                                SHA512

                                                                                                ef83dcbfe1256074bbe8498c21fab94ab98af4b82c21378c5ff89e481f6bb1dab05a37a85cab3e597195b6709237b62133e5ad59d822c6678afe5ee9da9491d1

                                                                                              • \??\c:\windows\SysWOW64\colun.cc3

                                                                                                Filesize

                                                                                                23.1MB

                                                                                                MD5

                                                                                                c34452ae524c27a3be22e8ccb1422251

                                                                                                SHA1

                                                                                                911a4287a6bf4efd879b4bcaf3e47db88aaebc41

                                                                                                SHA256

                                                                                                52084175858039afd5140ece3ab36569ab1c75122b9077f41bf7b61f8a4f7082

                                                                                                SHA512

                                                                                                e5248f0880b64ed45c88f2518743933151f2fb5f1d82938c590628a8d25818b53db9cb0787ebe4f208ed87bd98d4f457854328722c7298e7cc63c82dc5809579

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                24.0MB

                                                                                                MD5

                                                                                                e7d9f25d4f49198cc371d6fb9aa63958

                                                                                                SHA1

                                                                                                6c4a87961b55d4fe04f9d47452d2e59bb5131ca0

                                                                                                SHA256

                                                                                                0fd2f2fc8626f914bedd9ad1bc1814d203ac9d33651403c756e7b99f62b21dbd

                                                                                                SHA512

                                                                                                2cb2a11ffdec272d824faf251f60fa69cc4154fada387da241371a0ca8f7ffd28a4354a6597a58fb6775e09a4e94cf014bd4f12922ab7d337c2e8bbc8bc32da5

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                21.0MB

                                                                                                MD5

                                                                                                a42876c7ae5430b2cc95ab6da0604d93

                                                                                                SHA1

                                                                                                401eb48386df39ef4b42cc13d10dc10797c1fc25

                                                                                                SHA256

                                                                                                721bbf1bd16aa538b8bc4c0d0af1c215574f0f96f881998460fb68d8291a4dc7

                                                                                                SHA512

                                                                                                3ec2c5c036867d76309391ddc7a230477d4af97c236cc02bf3f89c2acb727f1c57d3219b648aae613013190d59d17fbf1ab18839bc0da9685671c41178a2fb57

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                23.0MB

                                                                                                MD5

                                                                                                e0d6f663136ae0c73ec7d9b154084036

                                                                                                SHA1

                                                                                                5df3fa5e4adcded33671e43a7281b301854dc4c7

                                                                                                SHA256

                                                                                                2e08234256d6f93ecc7c84b06c72fa31d22d0ca3849faa4021d2b3c3b1b00c6d

                                                                                                SHA512

                                                                                                103cd84a5cc67959b9922c6b26df7b25cd991cdc70e450ab7ba0c340f11e556a5f8ac7cb6e40fcda4b38e022f477435b1260779ce2dd19df0498f4683b3e6f5d

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                24.1MB

                                                                                                MD5

                                                                                                3de58d1d8c096a0c4799eedfde81b294

                                                                                                SHA1

                                                                                                c4e4488218f8eb03c301c082e8edf8d3d523e288

                                                                                                SHA256

                                                                                                16ae59eb56c9c28e404652a6c5e1e9f4ad1d638d3578974f97230ec7bd696ab0

                                                                                                SHA512

                                                                                                b55e8a42ca01579934b2f2d1cf51262130612413923d9b13eebe92b0551a11790c349deb8bdc9c6112f0a622fdec1c68dbb4139ed0a5d29d1ccb7e12afa6c00b

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                24.0MB

                                                                                                MD5

                                                                                                5920118e137d0a4b566bfe6deaa66f91

                                                                                                SHA1

                                                                                                439db65964d68731c0835c063221930c4f9b63ae

                                                                                                SHA256

                                                                                                f8bfb48dc151f620b2e876d3b4bd9374a636e3f6d2e6cf44c13f0e9605900b22

                                                                                                SHA512

                                                                                                92c793d6460866e67bd6c09138c1524a2c4b13d877ef54e46249a1496a9790c21367931413ad069b469139c0f983629d12cc34717477fcd59f3534d01bad202c

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                21.0MB

                                                                                                MD5

                                                                                                fde800af9d1a203665fc1e91a24491fc

                                                                                                SHA1

                                                                                                8bbe6b61fc324ffb08f18c93688aaf080ccf37ef

                                                                                                SHA256

                                                                                                533a6d5ca30839b7fe23cc6bd0ec9cb1781aa4e60a258889baaedd4210708c2e

                                                                                                SHA512

                                                                                                82a3e0c63a1dcfaae8110c55c3d5498f2ba322f348a66de5916cdd24850d5b6325213d4248ad2ce88179f849195878d6eedccb0d21f1a1ba4ca4cf1a416310bb

                                                                                              • \??\c:\windows\SysWOW64\rdohr.cc3

                                                                                                Filesize

                                                                                                23.0MB

                                                                                                MD5

                                                                                                c620819344633d9a7215f2f2df83e68d

                                                                                                SHA1

                                                                                                c4882cb93b7df91c064f828c17d2dcce8ee64263

                                                                                                SHA256

                                                                                                ffa0668ab47706eee7f2711af219781f0247a2972f777f53ef82bdc7ec44852e

                                                                                                SHA512

                                                                                                dd963cbff342a3af0643fc4f01a08e776d28bdcc69befabc4bc6d44449e3c308d0d87ef944fd6c98a9b6378bb1b96584c6ff1356d879a3adfdc4fc51879978a5

                                                                                              • memory/1292-29-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                Filesize

                                                                                                32KB

                                                                                              • memory/1292-0-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                Filesize

                                                                                                32KB