gh0strat | 962a22738f293250720a92b9a81ba199d144f3b6cf646f6e97151696f6e38756

Analysis

max time kernel
107s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
Size

270KB
MD5

fe793af48ea5f6a280b870e90d3ac04c
SHA1

31ea595d97f612905124203dd1c1d7c5fa902415
SHA256

962a22738f293250720a92b9a81ba199d144f3b6cf646f6e97151696f6e38756
SHA512

cbb213fb49fee2c345a4ba5763c3be3ff53474d864dda2fdd549ffd37d18363a9f33fe62907dd2b5db7de98b02d0b5db31b931d21ce0976e3a9c22ad879b0f17
SSDEEP

6144:eOnRyfNFO0HR7Wu55Onn+VI3zMJ79Wm0fvxT6/eaZ:eI8fNBHlV5I+coJZ+5G/l

Score

10^/10

gh0strat defense_evasion discovery rat

Malware Config

Signatures

Gh0st RAT payload 14 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023440-27.dat	family_gh0strat
behavioral2/files/0x000c000000023446-34.dat	family_gh0strat
behavioral2/files/0x000a000000023440-40.dat	family_gh0strat
behavioral2/files/0x0018000000023446-46.dat	family_gh0strat
behavioral2/files/0x002b00000002344c-52.dat	family_gh0strat
behavioral2/files/0x001a000000023446-58.dat	family_gh0strat
behavioral2/files/0x002d00000002344c-64.dat	family_gh0strat
behavioral2/files/0x001c000000023446-70.dat	family_gh0strat
behavioral2/files/0x002f00000002344c-76.dat	family_gh0strat
behavioral2/files/0x001e000000023446-82.dat	family_gh0strat
behavioral2/files/0x0016000000021a6e-88.dat	family_gh0strat
behavioral2/files/0x0021000000021a71-94.dat	family_gh0strat
behavioral2/files/0x0018000000021a6e-100.dat	family_gh0strat
behavioral2/files/0x0023000000021a71-107.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe

Executes dropped EXE 4 IoCs

pid	Process
1168	en.exe
4748	install4821093.exe
3768	qa.exe
1612	install4903109.exe

Loads dropped DLL 45 IoCs

pid	Process
4472	svchost.exe
1408	svchost.exe
3212	svchost.exe
676	svchost.exe
1996	svchost.exe
4856	svchost.exe
1076	svchost.exe
1016	svchost.exe
3568	svchost.exe
5084	svchost.exe
4256	svchost.exe
1972	svchost.exe
3036	svchost.exe
4820	svchost.exe
1264	svchost.exe
1712	svchost.exe
2172	svchost.exe
340	svchost.exe
3648	svchost.exe
2640	svchost.exe
4368	svchost.exe
2788	svchost.exe
2244	svchost.exe
4536	svchost.exe
4988	svchost.exe
456	svchost.exe
4456	svchost.exe
752	svchost.exe
1832	svchost.exe
4560	svchost.exe
3332	svchost.exe
1544	svchost.exe
3056	svchost.exe
1588	svchost.exe
1300	svchost.exe
4660	svchost.exe
4556	svchost.exe
1368	svchost.exe
4688	svchost.exe
3484	svchost.exe
3748	svchost.exe
3312	svchost.exe
4456	svchost.exe
384	svchost.exe
4452	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\colun.cc3	install4903109.exe
File opened for modification	C:\Windows\SysWOW64\rdohr.cc3	install4821093.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 45 IoCs

pid	pid_target	Process	procid_target
2964	4472	WerFault.exe	86
2172	1408	WerFault.exe	92
2984	3212	WerFault.exe	95
3596	676	WerFault.exe	98
4436	1996	WerFault.exe	103
1988	4856	WerFault.exe	106
3464	1076	WerFault.exe	112
4944	1016	WerFault.exe	117
4536	3568	WerFault.exe	120
2892	5084	WerFault.exe	123
4388	4256	WerFault.exe	126
4788	1972	WerFault.exe	129
932	3036	WerFault.exe	133
560	4820	WerFault.exe	136
2104	1264	WerFault.exe	140
1452	1712	WerFault.exe	143
2236	2172	WerFault.exe	146
5004	340	WerFault.exe	149
3804	3648	WerFault.exe	152
1988	2640	WerFault.exe	155
1368	4368	WerFault.exe	158
2904	2788	WerFault.exe	161
1280	2244	WerFault.exe	164
1180	4536	WerFault.exe	167
1112	4988	WerFault.exe	170
2808	456	WerFault.exe	173
712	4456	WerFault.exe	176
3980	752	WerFault.exe	179
3036	1832	WerFault.exe	182
1552	4560	WerFault.exe	185
224	3332	WerFault.exe	188
4112	1544	WerFault.exe	191
4216	3056	WerFault.exe	194
340	1588	WerFault.exe	197
4548	1300	WerFault.exe	200
5104	4660	WerFault.exe	203
4856	4556	WerFault.exe	206
1252	1368	WerFault.exe	209
468	4688	WerFault.exe	212
4356	3484	WerFault.exe	216
3000	3748	WerFault.exe	219
4300	3312	WerFault.exe	222
2660	4456	WerFault.exe	225
464	384	WerFault.exe	228
4044	4452	WerFault.exe	231

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install4821093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	en.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install4903109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00090000000233d9-5.dat	nsis_installer_2
behavioral2/files/0x000700000002343e-19.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
4748	install4821093.exe
4748	install4821093.exe
1612	install4903109.exe
1612	install4903109.exe
1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeBackupPrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	1612	install4903109.exe
Token: SeRestorePrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeBackupPrivilege	4748	install4821093.exe
Token: SeRestorePrivilege	4748	install4821093.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1168	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	82
PID 1292 wrote to memory of 1168	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	82
PID 1292 wrote to memory of 1168	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	82
PID 1168 wrote to memory of 4748	1168	en.exe	83
PID 1168 wrote to memory of 4748	1168	en.exe	83
PID 1168 wrote to memory of 4748	1168	en.exe	83
PID 1292 wrote to memory of 3768	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	84
PID 1292 wrote to memory of 3768	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	84
PID 1292 wrote to memory of 3768	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	84
PID 3768 wrote to memory of 1612	3768	qa.exe	85
PID 3768 wrote to memory of 1612	3768	qa.exe	85
PID 3768 wrote to memory of 1612	3768	qa.exe	85
PID 1292 wrote to memory of 4940	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	87
PID 1292 wrote to memory of 4940	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	87
PID 1292 wrote to memory of 4940	1292	fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe793af48ea5f6a280b870e90d3ac04c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\ProgramData\en.exe
  "C:\ProgramData\en.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Roaming\install4821093.exe
    C:\Users\Admin\AppData\Roaming\install4821093.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\ProgramData\qa.exe
  "C:\ProgramData\qa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Users\Admin\AppData\Roaming\install4903109.exe
    C:\Users\Admin\AppData\Roaming\install4903109.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\FE793A~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 592
  2⤵
  - Program crash
  PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4472 -ip 4472
1⤵
PID:2944

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 596
  2⤵
  - Program crash
  PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1408 -ip 1408
1⤵
PID:3300

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 592
  2⤵
  - Program crash
  PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3212 -ip 3212
1⤵
PID:1340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 676 -s 592
  2⤵
  - Program crash
  PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 676 -ip 676
1⤵
PID:5048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 592
  2⤵
  - Program crash
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1996 -ip 1996
1⤵
PID:3648

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 592
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4856 -ip 4856
1⤵
PID:2344

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 592
  2⤵
  - Program crash
  PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1076 -ip 1076
1⤵
PID:3436

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 596
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1016 -ip 1016
1⤵
PID:1252

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 592
  2⤵
  - Program crash
  PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3568 -ip 3568
1⤵
PID:3624

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 592
  2⤵
  - Program crash
  PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5084 -ip 5084
1⤵
PID:3816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 588
  2⤵
  - Program crash
  PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4256 -ip 4256
1⤵
PID:4300

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 592
  2⤵
  - Program crash
  PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1972 -ip 1972
1⤵
PID:4620

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 592
  2⤵
  - Program crash
  PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 3036
1⤵
PID:3852

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 584
  2⤵
  - Program crash
  PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4820 -ip 4820
1⤵
PID:4560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 592
  2⤵
  - Program crash
  PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1264 -ip 1264
1⤵
PID:3264

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 600
  2⤵
  - Program crash
  PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1712 -ip 1712
1⤵
PID:3320

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 592
  2⤵
  - Program crash
  PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2172 -ip 2172
1⤵
PID:3224

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 592
  2⤵
  - Program crash
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 340 -ip 340
1⤵
PID:220

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 592
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3648 -ip 3648
1⤵
PID:1720

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 592
  2⤵
  - Program crash
  PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2640 -ip 2640
1⤵
PID:3108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 592
  2⤵
  - Program crash
  PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4368 -ip 4368
1⤵
PID:1096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 592
  2⤵
  - Program crash
  PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2788 -ip 2788
1⤵
PID:3728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 596
  2⤵
  - Program crash
  PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2244 -ip 2244
1⤵
PID:4140

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 592
  2⤵
  - Program crash
  PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4536 -ip 4536
1⤵
PID:744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 592
  2⤵
  - Program crash
  PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4988 -ip 4988
1⤵
PID:2940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 592
  2⤵
  - Program crash
  PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 456 -ip 456
1⤵
PID:4376

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 592
  2⤵
  - Program crash
  PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 4456 -ip 4456
1⤵
PID:5028

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 596
  2⤵
  - Program crash
  PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 752 -ip 752
1⤵
PID:4280

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 596
  2⤵
  - Program crash
  PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1832 -ip 1832
1⤵
PID:3272

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 592
  2⤵
  - Program crash
  PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4560 -ip 4560
1⤵
PID:1172

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 592
  2⤵
  - Program crash
  PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3332 -ip 3332
1⤵
PID:1456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 596
  2⤵
  - Program crash
  PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1544 -ip 1544
1⤵
PID:3300

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 596
  2⤵
  - Program crash
  PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3056 -ip 3056
1⤵
PID:4236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 592
  2⤵
  - Program crash
  PID:340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1588 -ip 1588
1⤵
PID:232

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 592
  2⤵
  - Program crash
  PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1300 -ip 1300
1⤵
PID:3760

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 592
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 4660 -ip 4660
1⤵
PID:3804

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 592
  2⤵
  - Program crash
  PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4556 -ip 4556
1⤵
PID:3460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 592
  2⤵
  - Program crash
  PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 964 -p 1368 -ip 1368
1⤵
PID:1308

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 592
  2⤵
  - Program crash
  PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 4688 -ip 4688
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry
1⤵
PID:2260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 544
  2⤵
  - Program crash
  PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3484 -ip 3484
1⤵
PID:1728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 540
  2⤵
  - Program crash
  PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3748 -ip 3748
1⤵
PID:4412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 540
  2⤵
  - Program crash
  PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3312 -ip 3312
1⤵
PID:5012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 540
  2⤵
  - Program crash
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4456 -ip 4456
1⤵
PID:3680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 540
  2⤵
  - Program crash
  PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 384 -ip 384
1⤵
PID:4680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 540
  2⤵
  - Program crash
  PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4452 -ip 4452
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\en.exe

Filesize
118KB

MD5
2d32fa5e3cb6e967cf3e93d14756c443

SHA1
fc584e983cddc75bd953c6fb47107b503e7c3b13

SHA256
ab74ee4cef9b9d08b9f46cc276047ff490b83588a0ef301e7982aae59663e888

SHA512
c187efea4808cd33d942acac74ac43b35cd336c992e6f277698e1ab60510fd7debc2d2650ffc4952d5715f1d54e6c58130a7ed838afb15fa072d5348e1b32a00

Download Submit
C:\ProgramData\qa.exe

Filesize
117KB

MD5
6f09bbc6d1e24d76251c0a566ca4310b

SHA1
f38af11d64517fd6e5294e6017e25c016fe0bd7d

SHA256
63bd165b4037893b26af4bf6a29e0dfe6637f0649caddd7196872e5fca2af8c0

SHA512
8eb44d4c7c08cd668b30236193512d1e274922b7b8a1c200af69edba1a83def382c7e2d8b32885fbc658b2ed3c5173fde095f79d39f5209ce51a6168b4f97db0

Download Submit
C:\Users\Admin\AppData\Roaming\install4821093.exe

Filesize
192KB

MD5
2cdced1cdbb37e687771c7eb297eebc5

SHA1
94ba6b37a5e81090672ed0dc6f4c63dc6b0ee537

SHA256
e008441c0d970ec6a3ac09027b5a32050599339d87ee5392457ce692d2099580

SHA512
330d6ba34633214f5a24e0d18a702121fc87b779ab37f79676f91c09db3be1c158d4e5606dd0529dddc2a822e6d07791a83d72cfbb7e38f8a8b2f38c9ec69def

Download Submit
C:\Users\Admin\AppData\Roaming\install4903109.exe

Filesize
192KB

MD5
1d3bf95fb92486b71c1c8939ebc27f08

SHA1
008b3fdf0b742b306f50f8503dc5be4b1023a4ca

SHA256
c333f006f231c1dd310d8f97010120cdf710f43fcb555eeec27232f202c2fcf8

SHA512
8f262e10fa53e70f41acb02fcc3208871d9b9ca5e263f3a70aa14aa4b8cb9169e73963740aa3e600e8e4830c67e5c6513721e36decf740f843c8ae8e7b0388e5

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
19.1MB

MD5
ce17b3971d39f6f7d3429b743ed1a29c

SHA1
a996be6afbe0b1f210e966588662c76967d10ad6

SHA256
65f4923f2848089bfbc4f4a55a4d1b8df0fa35952df03a4a07aa246bba7cf002

SHA512
04f24345488ac4900f214749ef92e922820e1b472f0c51cb2e7589073ebdfb03e6527a7311f31482a25578518a9d150bf0cdecd254700e939c387b5214ad2bf8

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
22.0MB

MD5
aeb9b59888ff5f6af810984e5d961ad7

SHA1
6d96db0e0eab7d417a040386ad713fd58c72a124

SHA256
bc1b09f4ae5a1ee44d47fd98e34009d54d1f555d6b584071e6e868db35a29df8

SHA512
76b4d4272d11a9b9388a2bb55b6934c23836b045ed8510f6823f04ab5158827c8c18b7b9c084ab62142fb2351314b3a6c7be587f121e4cbe186dce413f829f59

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
23.0MB

MD5
64ae65f32f5dd89de433d8448d91cc6e

SHA1
9405fbcc1164b1baf09231f13a84469c0c1c4dea

SHA256
2961e8eac39a65bce61ca57ca80e2ae5e9ad794ee1811c59e70451095cb40672

SHA512
cc9d0e2cb51fe0d5b27446bf26b05437893680b664835c6dc35582b262a6cf5d53428f5fab4e3193cfcd8bb2128d3ed850c4c638bfba2575a8b44b2668e756e1

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
23.1MB

MD5
fc14f5c16ecbf26668615f958640bf7d

SHA1
d90f5369ebfa7a48164e62d9e29faea6c6d6f231

SHA256
757f4e3c9b26caf17fc510ca396eb4735b82ff457a26788394480ae9fb78314c

SHA512
4f968d99f482486f9c191eeea0ffef4874aaa794b58f317b7f950b92234a99abf45a61a2e70074310f23cbc07256043d2c05fe88b50b26979cc66aa66df415e7

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
19.1MB

MD5
a317af347509adcb29f13e43a45e8fd3

SHA1
50889df200e550542ef38fd83b6392c4fc08a27f

SHA256
ef6d0ece043eb71e2704b77295f06661e81f3437dddd2147cee50eb88ed22368

SHA512
4e1dd9cd110692dbf4b6881c0707b7378cb07b6019a9cdafd2be219ebfbcdd7f7907b62b5396b8bf2f8364b1e9a7f1bbfedb67aa72b2da4955f652b7cf130256

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
20.1MB

MD5
666da8c17b231ee81ada7a1211436b0e

SHA1
06101c4868b0ef1a1056dc13d42d90bae031d05b

SHA256
e6f167af2b65b07a4b6c7c3fea8f7a3a8e41ae5f6153ff61e13ae92ba2cc12b2

SHA512
ef83dcbfe1256074bbe8498c21fab94ab98af4b82c21378c5ff89e481f6bb1dab05a37a85cab3e597195b6709237b62133e5ad59d822c6678afe5ee9da9491d1

Download Submit
\??\c:\windows\SysWOW64\colun.cc3

Filesize
23.1MB

MD5
c34452ae524c27a3be22e8ccb1422251

SHA1
911a4287a6bf4efd879b4bcaf3e47db88aaebc41

SHA256
52084175858039afd5140ece3ab36569ab1c75122b9077f41bf7b61f8a4f7082

SHA512
e5248f0880b64ed45c88f2518743933151f2fb5f1d82938c590628a8d25818b53db9cb0787ebe4f208ed87bd98d4f457854328722c7298e7cc63c82dc5809579

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
24.0MB

MD5
e7d9f25d4f49198cc371d6fb9aa63958

SHA1
6c4a87961b55d4fe04f9d47452d2e59bb5131ca0

SHA256
0fd2f2fc8626f914bedd9ad1bc1814d203ac9d33651403c756e7b99f62b21dbd

SHA512
2cb2a11ffdec272d824faf251f60fa69cc4154fada387da241371a0ca8f7ffd28a4354a6597a58fb6775e09a4e94cf014bd4f12922ab7d337c2e8bbc8bc32da5

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
21.0MB

MD5
a42876c7ae5430b2cc95ab6da0604d93

SHA1
401eb48386df39ef4b42cc13d10dc10797c1fc25

SHA256
721bbf1bd16aa538b8bc4c0d0af1c215574f0f96f881998460fb68d8291a4dc7

SHA512
3ec2c5c036867d76309391ddc7a230477d4af97c236cc02bf3f89c2acb727f1c57d3219b648aae613013190d59d17fbf1ab18839bc0da9685671c41178a2fb57

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
23.0MB

MD5
e0d6f663136ae0c73ec7d9b154084036

SHA1
5df3fa5e4adcded33671e43a7281b301854dc4c7

SHA256
2e08234256d6f93ecc7c84b06c72fa31d22d0ca3849faa4021d2b3c3b1b00c6d

SHA512
103cd84a5cc67959b9922c6b26df7b25cd991cdc70e450ab7ba0c340f11e556a5f8ac7cb6e40fcda4b38e022f477435b1260779ce2dd19df0498f4683b3e6f5d

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
24.1MB

MD5
3de58d1d8c096a0c4799eedfde81b294

SHA1
c4e4488218f8eb03c301c082e8edf8d3d523e288

SHA256
16ae59eb56c9c28e404652a6c5e1e9f4ad1d638d3578974f97230ec7bd696ab0

SHA512
b55e8a42ca01579934b2f2d1cf51262130612413923d9b13eebe92b0551a11790c349deb8bdc9c6112f0a622fdec1c68dbb4139ed0a5d29d1ccb7e12afa6c00b

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
24.0MB

MD5
5920118e137d0a4b566bfe6deaa66f91

SHA1
439db65964d68731c0835c063221930c4f9b63ae

SHA256
f8bfb48dc151f620b2e876d3b4bd9374a636e3f6d2e6cf44c13f0e9605900b22

SHA512
92c793d6460866e67bd6c09138c1524a2c4b13d877ef54e46249a1496a9790c21367931413ad069b469139c0f983629d12cc34717477fcd59f3534d01bad202c

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
21.0MB

MD5
fde800af9d1a203665fc1e91a24491fc

SHA1
8bbe6b61fc324ffb08f18c93688aaf080ccf37ef

SHA256
533a6d5ca30839b7fe23cc6bd0ec9cb1781aa4e60a258889baaedd4210708c2e

SHA512
82a3e0c63a1dcfaae8110c55c3d5498f2ba322f348a66de5916cdd24850d5b6325213d4248ad2ce88179f849195878d6eedccb0d21f1a1ba4ca4cf1a416310bb

Download Submit
\??\c:\windows\SysWOW64\rdohr.cc3

Filesize
23.0MB

MD5
c620819344633d9a7215f2f2df83e68d

SHA1
c4882cb93b7df91c064f828c17d2dcce8ee64263

SHA256
ffa0668ab47706eee7f2711af219781f0247a2972f777f53ef82bdc7ec44852e

SHA512
dd963cbff342a3af0643fc4f01a08e776d28bdcc69befabc4bc6d44449e3c308d0d87ef944fd6c98a9b6378bb1b96584c6ff1356d879a3adfdc4fc51879978a5

Download Submit
memory/1292-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1292-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download