Overview

overview

7

Static

static

3

82325c9210...18.exe

windows7-x64

7

82325c9210...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 07:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    82325c92109a19266fc3195801558fef_JaffaCakes118.exe
  • Size 264KB
  • Sample241031-h1eaxstaqa
  • SHA256 d24557340b7bd8f3eb37bfe2f3f0017487319e545543b3db2a2b467fa225354d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82325c92109a19266fc3195801558fef_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82325c92109a19266fc3195801558fef_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\wtutkpey.exe
      "C:\Windows\system32\wtutkpey.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Windows\SysWOW64\wqt.exe
        "C:\Windows\system32\wqt.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\SysWOW64\wyr.exe
          "C:\Windows\system32\wyr.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1868
          • C:\Windows\SysWOW64\wrwkjj.exe
            "C:\Windows\system32\wrwkjj.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3176
            • C:\Windows\SysWOW64\wihsy.exe
              "C:\Windows\system32\wihsy.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:2216
              • C:\Windows\SysWOW64\wopoxml.exe
                "C:\Windows\system32\wopoxml.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1668
                • C:\Windows\SysWOW64\wqru.exe
                  "C:\Windows\system32\wqru.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3520
                  • C:\Windows\SysWOW64\wbuso.exe
                    "C:\Windows\system32\wbuso.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:2132
                    • C:\Windows\SysWOW64\wbhxamd.exe
                      "C:\Windows\system32\wbhxamd.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Suspicious use of WriteProcessMemory
                      PID:4924
                      • C:\Windows\SysWOW64\wxhcrnd.exe
                        "C:\Windows\system32\wxhcrnd.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3544
                        • C:\Windows\SysWOW64\wbcjt.exe
                          "C:\Windows\system32\wbcjt.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          PID:2800
                          • C:\Windows\SysWOW64\wpugw.exe
                            "C:\Windows\system32\wpugw.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            PID:2020
                            • C:\Windows\SysWOW64\wiwmicbul.exe
                              "C:\Windows\system32\wiwmicbul.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:4032
                              • C:\Windows\SysWOW64\wwfyfsbw.exe
                                "C:\Windows\system32\wwfyfsbw.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                PID:3536
                                • C:\Windows\SysWOW64\wtoo.exe
                                  "C:\Windows\system32\wtoo.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  PID:2732
                                  • C:\Windows\SysWOW64\wjqshgkd.exe
                                    "C:\Windows\system32\wjqshgkd.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:4800
                                    • C:\Windows\SysWOW64\wcqchqf.exe
                                      "C:\Windows\system32\wcqchqf.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      PID:4240
                                      • C:\Windows\SysWOW64\wub.exe
                                        "C:\Windows\system32\wub.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        PID:3856
                                        • C:\Windows\SysWOW64\wvsgrriov.exe
                                          "C:\Windows\system32\wvsgrriov.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          PID:1208
                                          • C:\Windows\SysWOW64\wocxx.exe
                                            "C:\Windows\system32\wocxx.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            PID:4996
                                            • C:\Windows\SysWOW64\waouqy.exe
                                              "C:\Windows\system32\waouqy.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              PID:1156
                                              • C:\Windows\SysWOW64\wigbt.exe
                                                "C:\Windows\system32\wigbt.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                PID:3204
                                                • C:\Windows\SysWOW64\wmo.exe
                                                  "C:\Windows\system32\wmo.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1636
                                                  • C:\Windows\SysWOW64\wxmo.exe
                                                    "C:\Windows\system32\wxmo.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4480
                                                    • C:\Windows\SysWOW64\wpk.exe
                                                      "C:\Windows\system32\wpk.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      PID:440
                                                      • C:\Windows\SysWOW64\waelftdd.exe
                                                        "C:\Windows\system32\waelftdd.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2368
                                                        • C:\Windows\SysWOW64\wbyfbn.exe
                                                          "C:\Windows\system32\wbyfbn.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:960
                                                          • C:\Windows\SysWOW64\wkbt.exe
                                                            "C:\Windows\system32\wkbt.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            PID:2000
                                                            • C:\Windows\SysWOW64\wmyu.exe
                                                              "C:\Windows\system32\wmyu.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              PID:4924
                                                              • C:\Windows\SysWOW64\wqevv.exe
                                                                "C:\Windows\system32\wqevv.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                PID:4128
                                                                • C:\Windows\SysWOW64\wrogll.exe
                                                                  "C:\Windows\system32\wrogll.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  PID:3248
                                                                  • C:\Windows\SysWOW64\wxahnq.exe
                                                                    "C:\Windows\system32\wxahnq.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    PID:1716
                                                                    • C:\Windows\SysWOW64\wwwbwyey.exe
                                                                      "C:\Windows\system32\wwwbwyey.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:1860
                                                                      • C:\Windows\SysWOW64\wcgidkw.exe
                                                                        "C:\Windows\system32\wcgidkw.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5024
                                                                        • C:\Windows\SysWOW64\wxbhh.exe
                                                                          "C:\Windows\system32\wxbhh.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:3004
                                                                          • C:\Windows\SysWOW64\wknda.exe
                                                                            "C:\Windows\system32\wknda.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            PID:4056
                                                                            • C:\Windows\SysWOW64\wyur.exe
                                                                              "C:\Windows\system32\wyur.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              PID:2212
                                                                              • C:\Windows\SysWOW64\wvlhhy.exe
                                                                                "C:\Windows\system32\wvlhhy.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:1588
                                                                                • C:\Windows\SysWOW64\wvhbpoqhn.exe
                                                                                  "C:\Windows\system32\wvhbpoqhn.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3672
                                                                                  • C:\Windows\SysWOW64\wbcrd.exe
                                                                                    "C:\Windows\system32\wbcrd.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in System32 directory
                                                                                    PID:620
                                                                                    • C:\Windows\SysWOW64\wclctt.exe
                                                                                      "C:\Windows\system32\wclctt.exe"
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      PID:3280
                                                                                      • C:\Windows\SysWOW64\wrbdvko.exe
                                                                                        "C:\Windows\system32\wrbdvko.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        PID:2896
                                                                                        • C:\Windows\SysWOW64\wbiub.exe
                                                                                          "C:\Windows\system32\wbiub.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          PID:776
                                                                                          • C:\Windows\SysWOW64\wysjyl.exe
                                                                                            "C:\Windows\system32\wysjyl.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            PID:3956
                                                                                            • C:\Windows\SysWOW64\wvrnrmv.exe
                                                                                              "C:\Windows\system32\wvrnrmv.exe"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3692
                                                                                              • C:\Windows\SysWOW64\wkabn.exe
                                                                                                "C:\Windows\system32\wkabn.exe"
                                                                                                47⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                PID:4364
                                                                                                • C:\Windows\SysWOW64\wagnj.exe
                                                                                                  "C:\Windows\system32\wagnj.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1900
                                                                                                  • C:\Windows\SysWOW64\wnmbghw.exe
                                                                                                    "C:\Windows\system32\wnmbghw.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:1452
                                                                                                    • C:\Windows\SysWOW64\wgmjgq.exe
                                                                                                      "C:\Windows\system32\wgmjgq.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1868
                                                                                                      • C:\Windows\SysWOW64\welnyrs.exe
                                                                                                        "C:\Windows\system32\welnyrs.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in System32 directory
                                                                                                        PID:4832
                                                                                                        • C:\Windows\SysWOW64\wgcad.exe
                                                                                                          "C:\Windows\system32\wgcad.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          PID:4708
                                                                                                          • C:\Windows\SysWOW64\wpdpsk.exe
                                                                                                            "C:\Windows\system32\wpdpsk.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            PID:532
                                                                                                            • C:\Windows\SysWOW64\wevypdng.exe
                                                                                                              "C:\Windows\system32\wevypdng.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2276
                                                                                                              • C:\Windows\SysWOW64\wsemls.exe
                                                                                                                "C:\Windows\system32\wsemls.exe"
                                                                                                                55⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4480
                                                                                                                • C:\Windows\SysWOW64\wkcumc.exe
                                                                                                                  "C:\Windows\system32\wkcumc.exe"
                                                                                                                  56⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  PID:4572
                                                                                                                  • C:\Windows\SysWOW64\wfuohk.exe
                                                                                                                    "C:\Windows\system32\wfuohk.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:4996
                                                                                                                    • C:\Windows\SysWOW64\wrnacfic.exe
                                                                                                                      "C:\Windows\system32\wrnacfic.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in System32 directory
                                                                                                                      PID:2764
                                                                                                                      • C:\Windows\SysWOW64\wpyn.exe
                                                                                                                        "C:\Windows\system32\wpyn.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:3676
                                                                                                                        • C:\Windows\SysWOW64\wkppfkly.exe
                                                                                                                          "C:\Windows\system32\wkppfkly.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4908
                                                                                                                          • C:\Windows\SysWOW64\wbxddal.exe
                                                                                                                            "C:\Windows\system32\wbxddal.exe"
                                                                                                                            61⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4700
                                                                                                                            • C:\Windows\SysWOW64\wiuybf.exe
                                                                                                                              "C:\Windows\system32\wiuybf.exe"
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in System32 directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2424
                                                                                                                              • C:\Windows\SysWOW64\wcbion.exe
                                                                                                                                "C:\Windows\system32\wcbion.exe"
                                                                                                                                63⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1532
                                                                                                                                • C:\Windows\SysWOW64\wttnb.exe
                                                                                                                                  "C:\Windows\system32\wttnb.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in System32 directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2892
                                                                                                                                  • C:\Windows\SysWOW64\wmxe.exe
                                                                                                                                    "C:\Windows\system32\wmxe.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4592
                                                                                                                                    • C:\Windows\SysWOW64\wpvedan.exe
                                                                                                                                      "C:\Windows\system32\wpvedan.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:4996
                                                                                                                                      • C:\Windows\SysWOW64\wuxiw.exe
                                                                                                                                        "C:\Windows\system32\wuxiw.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:4872
                                                                                                                                        • C:\Windows\SysWOW64\wpbvi.exe
                                                                                                                                          "C:\Windows\system32\wpbvi.exe"
                                                                                                                                          68⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1372
                                                                                                                                          • C:\Windows\SysWOW64\wxyrgv.exe
                                                                                                                                            "C:\Windows\system32\wxyrgv.exe"
                                                                                                                                            69⤵
                                                                                                                                              PID:4128
                                                                                                                                              • C:\Windows\SysWOW64\wtbds.exe
                                                                                                                                                "C:\Windows\system32\wtbds.exe"
                                                                                                                                                70⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:1536
                                                                                                                                                • C:\Windows\SysWOW64\wyosrnfd.exe
                                                                                                                                                  "C:\Windows\system32\wyosrnfd.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:620
                                                                                                                                                  • C:\Windows\SysWOW64\wurfdqge.exe
                                                                                                                                                    "C:\Windows\system32\wurfdqge.exe"
                                                                                                                                                    72⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:4940
                                                                                                                                                    • C:\Windows\SysWOW64\wxpelgl.exe
                                                                                                                                                      "C:\Windows\system32\wxpelgl.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:912
                                                                                                                                                      • C:\Windows\SysWOW64\waqbepv.exe
                                                                                                                                                        "C:\Windows\system32\waqbepv.exe"
                                                                                                                                                        74⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:2500
                                                                                                                                                        • C:\Windows\SysWOW64\wws.exe
                                                                                                                                                          "C:\Windows\system32\wws.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3680
                                                                                                                                                          • C:\Windows\SysWOW64\wwvvqpdm.exe
                                                                                                                                                            "C:\Windows\system32\wwvvqpdm.exe"
                                                                                                                                                            76⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:832
                                                                                                                                                            • C:\Windows\SysWOW64\wlaqtjy.exe
                                                                                                                                                              "C:\Windows\system32\wlaqtjy.exe"
                                                                                                                                                              77⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:3520
                                                                                                                                                              • C:\Windows\SysWOW64\wcyoesuan.exe
                                                                                                                                                                "C:\Windows\system32\wcyoesuan.exe"
                                                                                                                                                                78⤵
                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:516
                                                                                                                                                                • C:\Windows\SysWOW64\wmdlypo.exe
                                                                                                                                                                  "C:\Windows\system32\wmdlypo.exe"
                                                                                                                                                                  79⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  PID:1032
                                                                                                                                                                  • C:\Windows\SysWOW64\wfuf.exe
                                                                                                                                                                    "C:\Windows\system32\wfuf.exe"
                                                                                                                                                                    80⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3344
                                                                                                                                                                    • C:\Windows\SysWOW64\wctj.exe
                                                                                                                                                                      "C:\Windows\system32\wctj.exe"
                                                                                                                                                                      81⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                      PID:1668
                                                                                                                                                                      • C:\Windows\SysWOW64\wlokhspv.exe
                                                                                                                                                                        "C:\Windows\system32\wlokhspv.exe"
                                                                                                                                                                        82⤵
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        PID:4836
                                                                                                                                                                        • C:\Windows\SysWOW64\wvenstui.exe
                                                                                                                                                                          "C:\Windows\system32\wvenstui.exe"
                                                                                                                                                                          83⤵
                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                          PID:2696
                                                                                                                                                                          • C:\Windows\SysWOW64\wjvxp.exe
                                                                                                                                                                            "C:\Windows\system32\wjvxp.exe"
                                                                                                                                                                            84⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4048
                                                                                                                                                                            • C:\Windows\SysWOW64\wuep.exe
                                                                                                                                                                              "C:\Windows\system32\wuep.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              PID:3472
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjvxp.exe"
                                                                                                                                                                              85⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:1208
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvenstui.exe"
                                                                                                                                                                            84⤵
                                                                                                                                                                              PID:4280
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlokhspv.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1060
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wctj.exe"
                                                                                                                                                                          82⤵
                                                                                                                                                                            PID:3872
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfuf.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:1160
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmdlypo.exe"
                                                                                                                                                                        80⤵
                                                                                                                                                                          PID:4052
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcyoesuan.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:216
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlaqtjy.exe"
                                                                                                                                                                      78⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1452
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwvvqpdm.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4260
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wws.exe"
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:1648
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waqbepv.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                    PID:4884
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxpelgl.exe"
                                                                                                                                                                  74⤵
                                                                                                                                                                    PID:3908
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wurfdqge.exe"
                                                                                                                                                                  73⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4008
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyosrnfd.exe"
                                                                                                                                                                72⤵
                                                                                                                                                                  PID:3096
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtbds.exe"
                                                                                                                                                                71⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1184
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxyrgv.exe"
                                                                                                                                                              70⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:4864
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpbvi.exe"
                                                                                                                                                            69⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5116
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuxiw.exe"
                                                                                                                                                          68⤵
                                                                                                                                                            PID:3288
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpvedan.exe"
                                                                                                                                                          67⤵
                                                                                                                                                            PID:828
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmxe.exe"
                                                                                                                                                          66⤵
                                                                                                                                                            PID:3264
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wttnb.exe"
                                                                                                                                                          65⤵
                                                                                                                                                            PID:3180
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcbion.exe"
                                                                                                                                                          64⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:464
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiuybf.exe"
                                                                                                                                                        63⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:1452
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbxddal.exe"
                                                                                                                                                      62⤵
                                                                                                                                                        PID:3488
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkppfkly.exe"
                                                                                                                                                      61⤵
                                                                                                                                                        PID:1648
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpyn.exe"
                                                                                                                                                      60⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2264
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrnacfic.exe"
                                                                                                                                                    59⤵
                                                                                                                                                      PID:2112
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfuohk.exe"
                                                                                                                                                    58⤵
                                                                                                                                                      PID:3968
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkcumc.exe"
                                                                                                                                                    57⤵
                                                                                                                                                      PID:2256
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsemls.exe"
                                                                                                                                                    56⤵
                                                                                                                                                      PID:1848
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wevypdng.exe"
                                                                                                                                                    55⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4400
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpdpsk.exe"
                                                                                                                                                  54⤵
                                                                                                                                                    PID:4360
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgcad.exe"
                                                                                                                                                  53⤵
                                                                                                                                                    PID:4464
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\welnyrs.exe"
                                                                                                                                                  52⤵
                                                                                                                                                    PID:3544
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgmjgq.exe"
                                                                                                                                                  51⤵
                                                                                                                                                    PID:2064
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnmbghw.exe"
                                                                                                                                                  50⤵
                                                                                                                                                    PID:1532
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 1364
                                                                                                                                                    50⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:440
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wagnj.exe"
                                                                                                                                                  49⤵
                                                                                                                                                    PID:1580
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkabn.exe"
                                                                                                                                                  48⤵
                                                                                                                                                    PID:2800
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvrnrmv.exe"
                                                                                                                                                  47⤵
                                                                                                                                                    PID:2976
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wysjyl.exe"
                                                                                                                                                  46⤵
                                                                                                                                                    PID:452
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbiub.exe"
                                                                                                                                                  45⤵
                                                                                                                                                    PID:1456
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrbdvko.exe"
                                                                                                                                                  44⤵
                                                                                                                                                    PID:2248
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wclctt.exe"
                                                                                                                                                  43⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2116
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbcrd.exe"
                                                                                                                                                42⤵
                                                                                                                                                  PID:1280
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvhbpoqhn.exe"
                                                                                                                                                41⤵
                                                                                                                                                  PID:4424
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvlhhy.exe"
                                                                                                                                                40⤵
                                                                                                                                                  PID:1844
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyur.exe"
                                                                                                                                                39⤵
                                                                                                                                                  PID:4836
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wknda.exe"
                                                                                                                                                38⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3824
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxbhh.exe"
                                                                                                                                              37⤵
                                                                                                                                                PID:1084
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcgidkw.exe"
                                                                                                                                              36⤵
                                                                                                                                                PID:1824
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwwbwyey.exe"
                                                                                                                                              35⤵
                                                                                                                                                PID:3040
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxahnq.exe"
                                                                                                                                              34⤵
                                                                                                                                                PID:4532
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrogll.exe"
                                                                                                                                              33⤵
                                                                                                                                                PID:3152
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqevv.exe"
                                                                                                                                              32⤵
                                                                                                                                                PID:4344
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmyu.exe"
                                                                                                                                              31⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:1512
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkbt.exe"
                                                                                                                                            30⤵
                                                                                                                                              PID:1440
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbyfbn.exe"
                                                                                                                                            29⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3836
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waelftdd.exe"
                                                                                                                                          28⤵
                                                                                                                                            PID:2312
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpk.exe"
                                                                                                                                          27⤵
                                                                                                                                            PID:216
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxmo.exe"
                                                                                                                                          26⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1908
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmo.exe"
                                                                                                                                        25⤵
                                                                                                                                          PID:1452
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wigbt.exe"
                                                                                                                                        24⤵
                                                                                                                                          PID:1588
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waouqy.exe"
                                                                                                                                        23⤵
                                                                                                                                          PID:2044
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wocxx.exe"
                                                                                                                                        22⤵
                                                                                                                                          PID:3536
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wvsgrriov.exe"
                                                                                                                                        21⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:3480
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wub.exe"
                                                                                                                                      20⤵
                                                                                                                                        PID:3064
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcqchqf.exe"
                                                                                                                                      19⤵
                                                                                                                                        PID:1372
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjqshgkd.exe"
                                                                                                                                      18⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3908
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtoo.exe"
                                                                                                                                    17⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:3764
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwfyfsbw.exe"
                                                                                                                                  16⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4728
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wiwmicbul.exe"
                                                                                                                                15⤵
                                                                                                                                  PID:1564
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1536
                                                                                                                                  15⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:2216
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpugw.exe"
                                                                                                                                14⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3672
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbcjt.exe"
                                                                                                                              13⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3240
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxhcrnd.exe"
                                                                                                                            12⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3008
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbhxamd.exe"
                                                                                                                          11⤵
                                                                                                                            PID:1436
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbuso.exe"
                                                                                                                          10⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4960
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqru.exe"
                                                                                                                        9⤵
                                                                                                                          PID:440
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wopoxml.exe"
                                                                                                                        8⤵
                                                                                                                          PID:5044
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wihsy.exe"
                                                                                                                        7⤵
                                                                                                                          PID:3712
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrwkjj.exe"
                                                                                                                        6⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:3908
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyr.exe"
                                                                                                                      5⤵
                                                                                                                        PID:3820
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqt.exe"
                                                                                                                      4⤵
                                                                                                                        PID:216
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtutkpey.exe"
                                                                                                                      3⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:4804
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1672
                                                                                                                      3⤵
                                                                                                                      • Program crash
                                                                                                                      PID:5112
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\82325c92109a19266fc3195801558fef_JaffaCakes118.exe"
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:3228
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3180 -ip 3180
                                                                                                                  1⤵
                                                                                                                    PID:1256
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4032 -ip 4032
                                                                                                                    1⤵
                                                                                                                      PID:1028
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1452 -ip 1452
                                                                                                                      1⤵
                                                                                                                        PID:3384

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            install[2].htm
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\install[2].htm
                                                                                                                            • Size 7KB
                                                                                                                            • SHA256 d5319a00eb7542e02c1e76cb20e2073c0411cd918e32094bc66f9147a0bfae6d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            waelftdd.exe
                                                                                                                            • Path C:\Windows\SysWOW64\waelftdd.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 a01d73f01962df2755cc352e30773b9a147e11218c5dc5d16d7846b9aaf91c25
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            waouqy.exe
                                                                                                                            • Path C:\Windows\SysWOW64\waouqy.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 188722d630666ab6b5e4af843c16034f66ca65e1a6cfb7bb9a6ff783cadf427e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wbcjt.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wbcjt.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 d1f28dfa8d2f622f88c7fd1ec1d8ae5a6c99fbde5b639b338c7b9476d1a1b4cf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wbhxamd.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wbhxamd.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 d40c542caeef43820a444f45d982e997bafddd7d4e29172eb7f6eeaae7997634
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wbuso.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wbuso.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 dabc63e029922d4522a1a5bf2c639dff346611a1bf261106b8f6e82b06d5dd3f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wbyfbn.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wbyfbn.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 f9206598e4f80c2a43dbaf86bc61bf6198db1e7659df66100d33dda753704c33
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wcqchqf.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wcqchqf.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 a07828a3d4f1fca12239f79197d2453e6eef2d4f3da4465db9524383e5ffa88a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wigbt.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wigbt.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 a57f36e8be62cda680474472c391f0286ebb98736f3a24fc6c5ea9779e9a0e06
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wihsy.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wihsy.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 8650e32b5c641ead588c964934cf3f10b5ae69d4b55b523422cc7a8216777649
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wiwmicbul.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wiwmicbul.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 65aa7de5ccce0b44d018e98697007e8b0b1469c1e501730c954ce9dcef4f0008
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wjqshgkd.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wjqshgkd.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 5eaccec16468bb47b96557b22845b77d247b500a686969b3c19140978b252a31
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wkbt.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wkbt.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 40e5c6253d42989f53aa136d1ee078f3d23437f9d82c4ca3bcf4b03f34a14cfe
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wmo.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wmo.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 c13030903de390e692b7860b83e34787e0533c8813464605a9d2e0d5403d4f7b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wmyu.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wmyu.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 5143c2b721fbdc6cd5074849a10a89b45882a4d69319e3384f3d8bcc2a7a9052
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wocxx.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wocxx.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 e0e802640ca7f9dc004ebc625030457ad34606680d468b0143a1834baa400483
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wopoxml.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wopoxml.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 d1da9125de05832ef865b9a42fcad17e81f73247d1ce3553609b757591a6e0bf
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wpk.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wpk.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 c360d6790e71a345cce0c137ec023b481b3366de4eca7b9897fcbb2e57c0974b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wpugw.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wpugw.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 f45bfeb2dd0981973586e7c58164b40870b3620f57855f526add79e1c22f501e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wqevv.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wqevv.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 34ab2c9867927de8fa6df41620fd9b98a3e6fe4fd5333c3ff5614db89a35ea30
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wqru.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wqru.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 23a6aa9b269a10996bf8374b57bb0c11674710dfcf79536bd387ce737042445d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wqt.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wqt.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 045a73b56534cbf8fd59a05644b365453ebdcbb1d8bc29a9924ba42eec9101a1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wrogll.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wrogll.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 30142e35da7449745d59819e081ce749278bc0219febac8dc1c337ee0575ed3c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wrwkjj.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wrwkjj.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 95e579211ec66c0645c87820d37351a8f9f85b8d05e8dc901e4073aa69358a4b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wtoo.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wtoo.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 369daeeed420f5452fd20f3503b6f0d53763e9a8e5858aebdc4e9906d6f4a6df
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wtutkpey.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wtutkpey.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 ed6a6ee793ebb1b616ab4ed33a021f475f4fdf2e23fcecc141dedbc5c9e09fb4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wub.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wub.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 5dae030661cee0241775053d3ca68335ed6e238ccd8b4e454d58e66d3a1cf6f4
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wvsgrriov.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wvsgrriov.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 028722261ec93324f04d80357067a036d4b57e83bc9c007350e35c2272d8fbdb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wwfyfsbw.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wwfyfsbw.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 eca695c8a0ab6c0ce707170e298d61a10187ab3fe874c38738d40f769dfcabea
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wxahnq.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wxahnq.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 d911da0cc2ca41edd080ae686c868b0fa6323efd972fe80234b939b547503a6c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wxhcrnd.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wxhcrnd.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 9498aa23cb07995f6dbb7fab9c4d7931423db2bf0fd5b4f7f587e5979aa6ed15
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wxmo.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wxmo.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 1e12624f5d819199dda95dd0e735c8ca3a405d824fab2428b57640fae2bdfb82
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            wyr.exe
                                                                                                                            • Path C:\Windows\SysWOW64\wyr.exe
                                                                                                                            • Size 264KB
                                                                                                                            • SHA256 71b76d01a2c1b4f102dea39546df3025231905ee94b202e7507099fc0f826e05
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                            Submit Download

                                                                                                                            memory/440-276-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/516-721-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/532-518-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/620-663-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/620-414-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/776-439-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/832-704-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/912-679-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/932-23-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/932-34-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/960-296-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1032-729-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1156-235-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1208-214-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1372-639-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1452-482-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1532-599-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1536-655-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1588-398-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1636-256-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1668-746-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1668-76-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1716-346-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1860-354-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1868-45-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1868-491-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1900-474-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1952-12-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1952-9-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1952-0-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2000-306-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2020-142-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2020-130-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2132-97-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2212-390-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2216-66-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2276-526-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2368-286-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2424-591-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2500-687-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2696-763-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2732-172-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2764-559-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2800-131-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2892-607-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2896-431-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3004-372-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3176-56-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3180-22-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3204-246-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3248-338-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3280-423-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3344-738-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3472-772-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3520-712-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3520-87-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3536-162-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3544-119-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3672-406-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3676-567-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3680-695-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3692-457-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3856-203-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3956-448-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4032-152-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4048-771-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4056-381-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4128-327-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4128-647-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4240-193-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4364-466-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4480-535-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4480-266-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4572-543-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4592-615-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4700-583-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4708-509-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4708-500-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4800-182-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4832-501-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4836-754-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4872-631-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4908-575-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4924-316-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4924-98-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4924-108-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4940-671-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4996-623-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4996-551-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4996-225-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5024-363-0x0000000000400000-0x0000000000417000-memory.dmp
                                                                                                                            Download