cybergate | 74d7fde66545a72106ec98473bb329fb21514fc267ef5723ac195a0522422859

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Size

961KB
MD5

c67a1c0ea5ae95b146f7fcdb65824440
SHA1

2a2b6ca5b2572b829879b299017ae73119919b96
SHA256

74d7fde66545a72106ec98473bb329fb21514fc267ef5723ac195a0522422859
SHA512

a6eb0735668b8318667b6b5ab00cf603407a511c50534b3324a41f90375346c29907ceae42f507598a31bffcb94b8997a90125578467652fbc27e9462d33ef6d
SSDEEP

24576:kYd474mfxouZ39KbuXuHiR7QQcI8JOvT7aRgACGhV:dOPfKYpuHiaQcIQOvigACC

Score

10^/10

cybergate off discovery evasion persistence stealer themida trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

off

Sprite089.no-ip.info:81

Mutex

X83WK4WFK6D8R2

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
explorer.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
Error
password
cybergate
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\explorer.exe"	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\explorer.exe"	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I5VN10N5-TCY4-MW3M-0KC7-4QP64JDH1JU8}\StubPath = "C:\\Windows\\install\\explorer.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I5VN10N5-TCY4-MW3M-0KC7-4QP64JDH1JU8}	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{I5VN10N5-TCY4-MW3M-0KC7-4QP64JDH1JU8}\StubPath = "C:\\Windows\\install\\explorer.exe Restart"	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I5VN10N5-TCY4-MW3M-0KC7-4QP64JDH1JU8}	explorer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe

Executes dropped EXE 5 IoCs

pid	Process
2432	explorer.exe
2644	explorer.exe
1948	explorer.exe
3400	explorer.exe
700	explorer.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Wine	explorer.exe

Themida packer 13 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/4736-0-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/4736-17-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/files/0x0068000000023c85-74.dat	themida
behavioral2/memory/4336-82-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/4336-130-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/4736-148-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/2432-175-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/2644-202-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/1948-205-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/1948-246-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/2432-253-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/700-260-0x0000000000400000-0x00000000004F3000-memory.dmp	themida
behavioral2/memory/2644-358-0x0000000000400000-0x00000000004F3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\explorer.exe"	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\explorer.exe"	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4736-5-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral2/memory/4736-8-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4736-68-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2016-72-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/2016-117-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral2/memory/4336-151-0x0000000010560000-0x00000000105C5000-memory.dmp	upx
behavioral2/memory/4336-218-0x0000000010560000-0x00000000105C5000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\install\explorer.exe	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
File opened for modification	C:\Windows\install\explorer.exe	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
File opened for modification	C:\Windows\install\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3848	4736	WerFault.exe	82
2320	4736	WerFault.exe	82
1632	4736	WerFault.exe	82
1748	4736	WerFault.exe	82
4856	4736	WerFault.exe	82
5060	4736	WerFault.exe	82
5088	4736	WerFault.exe	82
3488	4736	WerFault.exe	82
5084	4736	WerFault.exe	82
1992	4736	WerFault.exe	82
2120	4736	WerFault.exe	82
1588	4736	WerFault.exe	82
3516	4736	WerFault.exe	82
4544	4736	WerFault.exe	82
3452	4736	WerFault.exe	82
4748	4736	WerFault.exe	82
548	4736	WerFault.exe	82
3936	4736	WerFault.exe	82
2916	4736	WerFault.exe	82
2256	4736	WerFault.exe	82
3996	4736	WerFault.exe	82
4408	4736	WerFault.exe	82
3688	4736	WerFault.exe	82
5016	4736	WerFault.exe	82
2752	4736	WerFault.exe	82
3084	4336	WerFault.exe	136
1808	4336	WerFault.exe	136
1088	4336	WerFault.exe	136
5088	4336	WerFault.exe	136
3160	4336	WerFault.exe	136
4100	4336	WerFault.exe	136
1556	4336	WerFault.exe	136
3004	4336	WerFault.exe	136
1172	4336	WerFault.exe	136
2020	4336	WerFault.exe	136
5112	4336	WerFault.exe	136
4548	4336	WerFault.exe	136
1816	4336	WerFault.exe	136
1192	4336	WerFault.exe	136
4328	4336	WerFault.exe	136
4528	4336	WerFault.exe	136
1800	4336	WerFault.exe	136
2580	4336	WerFault.exe	136
3168	4336	WerFault.exe	136
5116	4336	WerFault.exe	136
3584	4336	WerFault.exe	136
4716	4336	WerFault.exe	136
5020	4336	WerFault.exe	136
2932	4336	WerFault.exe	136
2928	4336	WerFault.exe	136
1632	2432	WerFault.exe	187
1688	4336	WerFault.exe	136
5080	4336	WerFault.exe	136
3816	4336	WerFault.exe	136
1736	2432	WerFault.exe	187
440	4336	WerFault.exe	136
4068	2432	WerFault.exe	187
4840	4336	WerFault.exe	136
2372	2432	WerFault.exe	187
244	4336	WerFault.exe	136
4544	2432	WerFault.exe	187
2424	4336	WerFault.exe	136
3624	2432	WerFault.exe	187
1100	4336	WerFault.exe	136

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
2432	explorer.exe
2432	explorer.exe
700	explorer.exe
700	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4336	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	2016	explorer.exe
Token: SeRestorePrivilege	2016	explorer.exe
Token: SeBackupPrivilege	4336	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Token: SeRestorePrivilege	4336	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Token: SeDebugPrivilege	4336	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Token: SeDebugPrivilege	4336	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
Token: SeBackupPrivilege	3400	explorer.exe
Token: SeRestorePrivilege	3400	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56
PID 4736 wrote to memory of 3428	4736	c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 276
    3⤵
    - Program crash
    PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 332
    3⤵
    - Program crash
    PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 344
    3⤵
    - Program crash
    PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 500
    3⤵
    - Program crash
    PID:1748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 484
    3⤵
    - Program crash
    PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 520
    3⤵
    - Program crash
    PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 488
    3⤵
    - Program crash
    PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 508
    3⤵
    - Program crash
    PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 516
    3⤵
    - Program crash
    PID:5084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 484
    3⤵
    - Program crash
    PID:1992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 480
    3⤵
    - Program crash
    PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 340
    3⤵
    - Program crash
    PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 504
    3⤵
    - Program crash
    PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 536
    3⤵
    - Program crash
    PID:4544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 540
    3⤵
    - Program crash
    PID:3452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 508
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 328
    3⤵
    - Program crash
    PID:548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 428
    3⤵
    - Program crash
    PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 480
    3⤵
    - Program crash
    PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 492
    3⤵
    - Program crash
    PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 524
    3⤵
    - Program crash
    PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 484
    3⤵
    - Program crash
    PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 340
    3⤵
    - Program crash
    PID:3688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 516
    3⤵
    - Program crash
    PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 344
    3⤵
    - Program crash
    PID:2752
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
  - - C:\Windows\install\explorer.exe
      "C:\Windows\install\explorer.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2432
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 276
        5⤵
        Program crash
        
        PID:1632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 312
        5⤵
        Program crash
        
        PID:1736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 320
        5⤵
        Program crash
        
        PID:4068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 500
        5⤵
        Program crash
        
        PID:2372
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 520
        5⤵
        Program crash
        
        PID:4544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 508
        5⤵
        Program crash
        
        PID:3624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 500
        5⤵
        
        PID:2736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 316
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 520
        5⤵
        
        PID:3492
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 492
        5⤵
        
        PID:2928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 480
        5⤵
        
        PID:4820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 524
        5⤵
        
        PID:1668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 520
        5⤵
        
        PID:512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 504
        5⤵
        
        PID:2020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 512
        5⤵
        
        PID:4444
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 484
        5⤵
        
        PID:1392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 540
        5⤵
        
        PID:3688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 520
        5⤵
        
        PID:4912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 528
        5⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 504
        5⤵
        
        PID:2484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 548
        5⤵
        
        PID:5080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 480
        5⤵
        
        PID:3748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 504
        5⤵
        
        PID:1148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 488
        5⤵
        
        PID:2104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 328
        5⤵
        
        PID:4528
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1324
    - - C:\Windows\install\explorer.exe
        
        "C:\Windows\install\explorer.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3400
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 244
        6⤵
        
        PID:1932
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 260
        6⤵
        
        PID:2264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 228
        6⤵
        
        PID:2104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 268
        6⤵
        
        PID:3688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 272
        6⤵
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 328
        6⤵
        
        PID:3348
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 336
        6⤵
        
        PID:216
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 300
        6⤵
        
        PID:4544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 276
        6⤵
        
        PID:1760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 292
        6⤵
        
        PID:3008
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 336
        6⤵
        
        PID:4068
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 288
        6⤵
        
        PID:404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 308
        6⤵
        
        PID:1224
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 284
        6⤵
        
        PID:3012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 296
        6⤵
        
        PID:3816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 276
        6⤵
        
        PID:880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 284
        6⤵
        
        PID:3032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 248
        6⤵
        
        PID:4456
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 344
        6⤵
        
        PID:2248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 352
        6⤵
        
        PID:3616
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 272
        6⤵
        
        PID:920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 428
        6⤵
        
        PID:1196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 436
        6⤵
        
        PID:2576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 464
        6⤵
        
        PID:3676
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 456
        6⤵
        
        PID:404
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 436
        6⤵
        
        PID:3472
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 452
        6⤵
        
        PID:2264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 488
        6⤵
        
        PID:3636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 496
        6⤵
        
        PID:3488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 512
        6⤵
        
        PID:4888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 500
        6⤵
        
        PID:2756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 488
        6⤵
        
        PID:1360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 476
        6⤵
        
        PID:4036
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 484
        6⤵
        
        PID:1580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 508
        6⤵
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 468
        6⤵
        
        PID:4888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 524
        6⤵
        
        PID:2696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 512
        6⤵
        
        PID:2208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 500
        6⤵
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 496
        6⤵
        
        PID:1588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 524
        6⤵
        
        PID:1576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 484
        6⤵
        
        PID:4480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 516
        6⤵
        
        PID:2792
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 552
        6⤵
        
        PID:4872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 468
        6⤵
        
        PID:3488
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 532
        6⤵
        
        PID:4424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 496
        6⤵
        
        PID:2992
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 516
        6⤵
        
        PID:1736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 588
        6⤵
        
        PID:3952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 596
        6⤵
        
        PID:4736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 532
        6⤵
        
        PID:5076
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 604
        6⤵
        
        PID:4140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 612
        6⤵
        
        PID:2696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 584
        6⤵
        
        PID:3424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 520
        6⤵
        
        PID:3636
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 592
        6⤵
        
        PID:5104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 572
        6⤵
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 544
        6⤵
        
        PID:384
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 752
        6⤵
        
        PID:972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1020
        6⤵
        
        PID:1360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 812
        6⤵
        
        PID:4684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1056
        6⤵
        
        PID:4444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 976
        6⤵
        
        PID:1228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 704
        6⤵
        
        PID:4840
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 564
        6⤵
        
        PID:1312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 704
        6⤵
        
        PID:3924
  - - C:\Windows\install\explorer.exe
      "C:\Windows\install\explorer.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      System Location Discovery: System Language Discovery
      PID:2644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 248
        5⤵
        
        PID:1244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 392
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 400
        5⤵
        
        PID:556
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 272
        5⤵
        
        PID:4796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 280
        5⤵
        
        PID:3024
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 468
        5⤵
        
        PID:4744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 288
        5⤵
        
        PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 404
        5⤵
        
        PID:1436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 392
        5⤵
        
        PID:2248
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 400
        5⤵
        
        PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 280
        5⤵
        
        PID:2348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 272
        5⤵
        
        PID:3424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 472
        5⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 284
        5⤵
        
        PID:3628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 396
        5⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 476
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 280
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 488
        5⤵
        
        PID:64
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 196
        5⤵
        
        PID:892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 480
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 272
        5⤵
        
        PID:4100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 388
        5⤵
        
        PID:5064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 404
        5⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 196
        5⤵
        
        PID:5068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 480
        5⤵
        
        PID:4920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 732
        5⤵
        
        PID:880
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c67a1c0ea5ae95b146f7fcdb65824440_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 240
      4⤵
      Program crash
      PID:3084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 288
      4⤵
      Program crash
      PID:1808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 296
      4⤵
      Program crash
      PID:1088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 224
      4⤵
      Program crash
      PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 264
      4⤵
      Program crash
      PID:3160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 268
      4⤵
      Program crash
      PID:4100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 312
      4⤵
      Program crash
      PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 252
      4⤵
      Program crash
      PID:3004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 280
      4⤵
      Program crash
      PID:1172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 304
      4⤵
      Program crash
      PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 284
      4⤵
      Program crash
      PID:5112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 240
      4⤵
      Program crash
      PID:4548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 308
      4⤵
      Program crash
      PID:1816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 244
      4⤵
      Program crash
      PID:1192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 296
      4⤵
      Program crash
      PID:4328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 300
      4⤵
      Program crash
      PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 220
      4⤵
      Program crash
      PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 260
      4⤵
      Program crash
      PID:2580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 376
      4⤵
      Program crash
      PID:3168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 384
      4⤵
      Program crash
      PID:5116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 352
      4⤵
      Program crash
      PID:3584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 292
      4⤵
      Program crash
      PID:4716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 252
      4⤵
      Program crash
      PID:5020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 364
      4⤵
      Program crash
      PID:2932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 292
      4⤵
      Program crash
      PID:2928
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 488
      4⤵
      Program crash
      PID:1688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 516
      4⤵
      Program crash
      PID:5080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 524
      4⤵
      Program crash
      PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 532
      4⤵
      Program crash
      PID:440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 384
      4⤵
      Program crash
      PID:4840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 536
      4⤵
      Program crash
      PID:244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 544
      4⤵
      Program crash
      PID:2424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 552
      4⤵
      Program crash
      PID:1100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 560
      4⤵
      PID:820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 524
      4⤵
      PID:4716
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 576
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 584
      4⤵
      PID:3036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 252
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 516
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 592
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 488
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 544
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 572
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 580
      4⤵
      PID:4816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 524
      4⤵
      PID:3476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 516
      4⤵
      PID:1328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 612
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 620
      4⤵
      PID:1348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 624
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 620
      4⤵
      PID:3804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 608
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 680
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 688
      4⤵
      PID:404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 628
      4⤵
      PID:4888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 696
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 700
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 736
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 220
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 992
      4⤵
      PID:3628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1176
      4⤵
      PID:2388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1184
      4⤵
      PID:3680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1212
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1188
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1180
      4⤵
      PID:3876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1224
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1228
      4⤵
      PID:3844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1248
      4⤵
      PID:3380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1244
      4⤵
      PID:2736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1252
      4⤵
      PID:4832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1252
      4⤵
      PID:4684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1220
      4⤵
      PID:2484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1280
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1284
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1356
      4⤵
      PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1240
      4⤵
      PID:2428
  - - C:\Windows\install\explorer.exe
      "C:\Windows\install\explorer.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious behavior: EnumeratesProcesses
      PID:700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 240
        5⤵
        
        PID:4684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 376
        5⤵
        
        PID:1228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 448
        5⤵
        
        PID:640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 456
        5⤵
        
        PID:4216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 468
        5⤵
        
        PID:3904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 452
        5⤵
        
        PID:2388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 384
        5⤵
        
        PID:3424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 376
        5⤵
        
        PID:3812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 456
        5⤵
        
        PID:3116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 472
        5⤵
        
        PID:4528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 468
        5⤵
        
        PID:1956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 504
        5⤵
        
        PID:2264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 392
        5⤵
        
        PID:3356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 484
        5⤵
        
        PID:4292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 512
        5⤵
        
        PID:952
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 384
        5⤵
        
        PID:2992
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 520
        5⤵
        
        PID:1808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 560
        5⤵
        
        PID:1760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 580
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 568
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 588
        5⤵
        
        PID:3612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 472
        5⤵
        
        PID:3036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 584
        5⤵
        
        PID:4260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 592
        5⤵
        
        PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 596
        5⤵
        
        PID:4184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1384
      4⤵
      PID:764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1372
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1668
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 1244
      4⤵
      PID:4560
- - C:\Windows\install\explorer.exe
    "C:\Windows\install\explorer.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:1948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 240
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 376
      4⤵
      PID:4528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 384
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 468
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 488
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 476
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 380
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 456
      4⤵
      PID:4912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 448
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 376
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 384
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 452
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 448
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 464
      4⤵
      PID:4492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 480
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 444
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 456
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 464
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 460
      4⤵
      PID:3804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 520
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 384
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 504
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 376
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 544
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 552
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 744
      4⤵
      PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4736 -ip 4736
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4736 -ip 4736
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4736 -ip 4736
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4736 -ip 4736
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4736 -ip 4736
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4736 -ip 4736
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4736 -ip 4736
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4736 -ip 4736
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4736 -ip 4736
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4736 -ip 4736
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4736 -ip 4736
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4736 -ip 4736
1⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4736 -ip 4736
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4736 -ip 4736
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4736 -ip 4736
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4736 -ip 4736
1⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4736 -ip 4736
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4736 -ip 4736
1⤵
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4736 -ip 4736
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4736 -ip 4736
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4736 -ip 4736
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4736 -ip 4736
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4736 -ip 4736
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4736 -ip 4736
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4736 -ip 4736
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4336 -ip 4336
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 4336
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4336 -ip 4336
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4336 -ip 4336
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4336 -ip 4336
1⤵
PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4336 -ip 4336
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4336 -ip 4336
1⤵
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4336 -ip 4336
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4336 -ip 4336
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4336 -ip 4336
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 4336
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 4336
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4336 -ip 4336
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4336 -ip 4336
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4336 -ip 4336
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4336 -ip 4336
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4336 -ip 4336
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4336 -ip 4336
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4336 -ip 4336
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4336 -ip 4336
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4336 -ip 4336
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4336 -ip 4336
1⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4336 -ip 4336
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2432 -ip 2432
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4336 -ip 4336
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4336 -ip 4336
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2432 -ip 2432
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4336 -ip 4336
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4336 -ip 4336
1⤵
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2432 -ip 2432
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2432 -ip 2432
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4336 -ip 4336
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2432 -ip 2432
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2432 -ip 2432
1⤵
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2432 -ip 2432
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2432 -ip 2432
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2432 -ip 2432
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4336 -ip 4336
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2432 -ip 2432
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2432 -ip 2432
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4336 -ip 4336
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2432 -ip 2432
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4336 -ip 4336
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4336 -ip 4336
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2432 -ip 2432
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4336 -ip 4336
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2432 -ip 2432
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4336 -ip 4336
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2432 -ip 2432
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4336 -ip 4336
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2432 -ip 2432
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4336 -ip 4336
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2432 -ip 2432
1⤵
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4336 -ip 4336
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2432 -ip 2432
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4336 -ip 4336
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2432 -ip 2432
1⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4336 -ip 4336
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2432 -ip 2432
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4336 -ip 4336
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2432 -ip 2432
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4336 -ip 4336
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2432 -ip 2432
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4336 -ip 4336
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2432 -ip 2432
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4336 -ip 4336
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2432 -ip 2432
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4336 -ip 4336
1⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2432 -ip 2432
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4336 -ip 4336
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2644 -ip 2644
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4336 -ip 4336
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4336 -ip 4336
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4336 -ip 4336
1⤵
PID:716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2644 -ip 2644
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4336 -ip 4336
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1948 -ip 1948
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2644 -ip 2644
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4336 -ip 4336
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2644 -ip 2644
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1948 -ip 1948
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4336 -ip 4336
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2644 -ip 2644
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1948 -ip 1948
1⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4336 -ip 4336
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1948 -ip 1948
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2644 -ip 2644
1⤵
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3400 -ip 3400
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1948 -ip 1948
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2644 -ip 2644
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3400 -ip 3400
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2644 -ip 2644
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4336 -ip 4336
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1948 -ip 1948
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3400 -ip 3400
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2644 -ip 2644
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4336 -ip 4336
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3400 -ip 3400
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1948 -ip 1948
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2644 -ip 2644
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3400 -ip 3400
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1948 -ip 1948
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2644 -ip 2644
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3400 -ip 3400
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1948 -ip 1948
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3400 -ip 3400
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4336 -ip 4336
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1948 -ip 1948
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3400 -ip 3400
1⤵
PID:1172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2644 -ip 2644
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1948 -ip 1948
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3400 -ip 3400
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2644 -ip 2644
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4336 -ip 4336
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1948 -ip 1948
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2644 -ip 2644
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1948 -ip 1948
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3400 -ip 3400
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2644 -ip 2644
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4336 -ip 4336
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1948 -ip 1948
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3400 -ip 3400
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2644 -ip 2644
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1948 -ip 1948
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3400 -ip 3400
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4336 -ip 4336
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2644 -ip 2644
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1948 -ip 1948
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3400 -ip 3400
1⤵
PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2644 -ip 2644
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3400 -ip 3400
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1948 -ip 1948
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4336 -ip 4336
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2644 -ip 2644
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3400 -ip 3400
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1948 -ip 1948
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2644 -ip 2644
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4336 -ip 4336
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1948 -ip 1948
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3400 -ip 3400
1⤵
PID:2276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2644 -ip 2644
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1948 -ip 1948
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3400 -ip 3400
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2644 -ip 2644
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4336 -ip 4336
1⤵
PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3400 -ip 3400
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1948 -ip 1948
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2644 -ip 2644
1⤵
PID:764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3400 -ip 3400
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4336 -ip 4336
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2644 -ip 2644
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1948 -ip 1948
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3400 -ip 3400
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1948 -ip 1948
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2644 -ip 2644
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3400 -ip 3400
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1948 -ip 1948
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4336 -ip 4336
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3400 -ip 3400
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1948 -ip 1948
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3400 -ip 3400
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1948 -ip 1948
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3400 -ip 3400
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4336 -ip 4336
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4336 -ip 4336
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3400 -ip 3400
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 700 -ip 700
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3400 -ip 3400
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3400 -ip 3400
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4336 -ip 4336
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 700 -ip 700
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3400 -ip 3400
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 700 -ip 700
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3400 -ip 3400
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 700 -ip 700
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3400 -ip 3400
1⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3400 -ip 3400
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 700 -ip 700
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3400 -ip 3400
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 700 -ip 700
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3400 -ip 3400
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 700 -ip 700
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 700 -ip 700
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3400 -ip 3400
1⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 700 -ip 700
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3400 -ip 3400
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 700 -ip 700
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3400 -ip 3400
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 700 -ip 700
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3400 -ip 3400
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 700 -ip 700
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3400 -ip 3400
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 700 -ip 700
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 700 -ip 700
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3400 -ip 3400
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 700 -ip 700
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3400 -ip 3400
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 700 -ip 700
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3400 -ip 3400
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 700 -ip 700
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3400 -ip 3400
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 700 -ip 700
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 700 -ip 700
1⤵
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3400 -ip 3400
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 700 -ip 700
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3400 -ip 3400
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 700 -ip 700
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3400 -ip 3400
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 700 -ip 700
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 700 -ip 700
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3400 -ip 3400
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 700 -ip 700
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3400 -ip 3400
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 700 -ip 700
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3400 -ip 3400
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3400 -ip 3400
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3400 -ip 3400
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3400 -ip 3400
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3400 -ip 3400
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3400 -ip 3400
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3400 -ip 3400
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 3400
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3400 -ip 3400
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3400 -ip 3400
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3400 -ip 3400
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3400 -ip 3400
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4336 -ip 4336
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 3400 -ip 3400
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3400 -ip 3400
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4336 -ip 4336
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4336 -ip 4336
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
d967ef56473a61c57267033d8236cc8e

SHA1
d52ecd13b9be765cf1edaf72ff45067912781b11

SHA256
d738dbde1e52b82e11eb58b4f1e0478a2f91f08b56959120b7bfd55b9c26fdf6

SHA512
8cf8e4bbd57edb4c76b59d04265e855c67fd2fd335e7dc4084c4247867e743e120f078054aebb9ab938796e85a016dcd097b891141cf23ee4cad70ff13d6c451

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin2.txt

Filesize
224KB

MD5
49bd5c940b6051a781d4e5164f579687

SHA1
c06b0424dbcabacbc2f9341ae2a06c33e85b36f3

SHA256
d4c05ba127e74ca76b19db55dc74275a4ba5322ea55574445b9d52827cf62207

SHA512
e59da3653a91efdb30364a3976f4f3bb76b6e76ce897472db5a24d7b966022d0cb70edd215b41dd7774c349b3b305cbcb1aef085bdedeffed7a3041ce58c26f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
77cdc8713f8c5eff9f028db8f4233905

SHA1
98a1f628794e982055bc387b95e553dc70011840

SHA256
93d17525f6cceb07398d4482211edca5f428b020eb2370ad2cfc092bcd5bcd5d

SHA512
fbdb1a74896191fe01ef3a51e33e398f5ddc98dc08958800250f82b22d9547cf28c416b3498e5e6b0f4b983d2dbefdda2f1ce4e26f0bc9c7af74147bfa797c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fa2f91529a31ea4c91bf2ccc88cd83ff

SHA1
516545a9af492c2444ab8656e8663668f90e3829

SHA256
b0d8d483d6298f8f1310f2eee5ee111ee5f29f9667c21472465583867a2c2e87

SHA512
eb9741d101d24982a72947432fcc511412bdede3bed3b78e6a1cb5d8a74efbe1c0b60a660455f992ebd076f3c8fe1afde0436625b89c68f62bdb16daa6710154

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
933fec2a2717594a65a6670c7a0e7608

SHA1
e600d6479dbe9b24644206995d92718ba5d34568

SHA256
303e85c4bfcc9bf08518d359db6b86352cc8b07bf25de62bce8e4e6384176ec4

SHA512
9907a671de96defffa69e1e1e89690e5bb577e899eb048a9aa303b2848ec9dd73217ca402b4384109221381686dfe08e4352405f4a7c88fdb5de6c35b8f692d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f2d9e5abd87ccfe20ddae84d4c403bc1

SHA1
9f8439cae5f5c09e21f316cdf4e37063a6e16cc0

SHA256
bbc65e862c519476aa0a6d71b3d2910eba5ef2104a30b581e85ae2a5d16a25da

SHA512
5a4f701c2c00b77764bf194aaece72cf701f545ddcfc30020d2a22c8ff8a536297db5a2389265ab7eba34d9b690cf6703fff5a8c395543f8e2cbcb9d3a19a486

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
b6835cac61ecc7aa730bf6d1624b0e7b

SHA1
d883db1cf5fab3100b3b0edf3249bea49c1b4ddd

SHA256
3eba41df5fce6e4d415b070f3956b191759658e037c79621495003fb9ed9d1ae

SHA512
faf774dba593948ae292159d4e0120f2df9c10a466df254b99db7b8fc0544bfc2acba8bad764e6c3ee8def48f90f84ce9610966539611e20bd13cbfeafe855bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
82a7b1a537b0aeba655a2b2939607fbf

SHA1
c1212c99d8a57528d9d8552a69787381dbab4646

SHA256
9999c0e2e8ace696fa48c1be81f19fdd7dc3b6aab4e58486ff118c1bae422c11

SHA512
4ea255cd84cc22dc7007ae3ec9953ca2ee1f3030dd7bae2aa3308b6e48c356f8450155fc19faa7502256dba83618736974673aa7ec5e47199affd8a2263d3d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3698e21f3c51f0fc76819abfbb4b3b6a

SHA1
23f8290b119e4f51e591007032852457de1f595f

SHA256
fd732ca93930ad6f060c0e222c46463918522acd0c235cbcbc4868a1f21b90df

SHA512
2281bfa3620ee420779e6a3fa8d62d8db8deb896c009655dd4ed489d028242ec34dde31ee783370f7a8a883d700fac79ac413acbf7872a915e82683b577141e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ea2ea71bee6f1de787e173623fd65caa

SHA1
8d30dc3b24d9621ec1c3af6c1955160f2dcebb2c

SHA256
2d634c8ad76f2624e827c1eb3536dba64f771989e318d14ac2696c4ed07f0803

SHA512
6c3dc7816fa99dbdcfdd1997d25721ffdf4bb193d945b109d04aaf2347f058da3fb847e507255b76adaecd8ecad659ed7d3acdb402064f3f2f6d93514ab6e654

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fadfab6f83f93c513e912134817c6118

SHA1
7214fae06abc01be7f69df00ff0b108d31861281

SHA256
359912b3860547c1bfd8807c1f608cd5ded85e9c1767a1393bd4b3b8c570629e

SHA512
7534d8b77e8d16f4143809d2e339f0430abadb6129e88a416105e916663a228e43214ebc44f2219ce4899d1175f3687b892f5320a98940953cb840e474bb67c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9feb328d8847508a391dfa8db6258e0e

SHA1
f25edd30b5dc565c74f7eb3b16dbc1ec02fd208f

SHA256
b14aeae36a74203f4861753914ddb6aca68579ceabab2aae07174415ff421045

SHA512
bb11e7353e2ac7ebb5d1ab50ac8414c04182d9dc57d4d4f088fb40618361600ca4836717a2804ff9b6f1a52fdf506ede5f478d0f06e159c1214f9cf0ea033cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8327256df0df5957ce26893fb7cd0405

SHA1
9d00613a80f515db7ad479cb5e472d7a1b5d9cee

SHA256
391b23ba87ab79d7405a78cb2eec9c7efdd6f1e532d421958971f0fb74e47642

SHA512
836f886f153bbdcc00871ddec83b825283b0b26e29c2ccb74236e837b3f64a09827b0b10e575e29e883ec5200bb84b2983cb11b4e246adb89ee331afd569aeb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
237a884d5f597a120096beeee1c215f3

SHA1
cbfd5e86cfd41095c5f013467fb02d18b2f299e2

SHA256
dc02f6c10ee5e68aa351be96a91afaa8d2b6d05deb29c8b5e5660869c9b4e8d4

SHA512
43f67d9344e3ba96e60598a9144dc3c467b782074e0041c0e30391caa4bbdbdb658662666bab7b6dfce96938f8c19d1d7b3fd9021c8aabfc1cb277bfb0d93196

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
35ae0581fff9886d66b8f00faa319c24

SHA1
84102341517365f5fe778325ef0123a5f1c27c3e

SHA256
c0c069e82034aec5f4f40b90f9d65ec4e26c954fbc4f7c7561a5166bf2329562

SHA512
f9f649157a2ae137b7cd53c35147e784a79fda40b53381443ce4a30ec674f51d8ca747bbad337258375f24d62f0d259c01f9bce4b32b2199357482315b9c77c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
79bf39095213e19a7e2e029ab5353d76

SHA1
2b96c479909520f2ff2d4b25d0e50306973ea36f

SHA256
f5248a7d4007ab330fe36543bf3053e643c4f7dfb77ac045518f70b16fa7f164

SHA512
b4d603a499fcb53cf03a9c32485a0ebbd0f37b064ef4594c6ee91f0d7c09e2db6091101951e788a82e1b355884f6170e91ee7432da3a5d4233f3e7a267e9355a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
894678ea08314812a4f7ec4920b4cca5

SHA1
339c1f09282a283b44559300ade514534ec05aa2

SHA256
4703436e80a897f1c004c5b8f1fa4deb245e05c5cf2ee2595fcc5ef0c8e8442b

SHA512
d7b3ffb14e8c80e8e7e687c4ca7cd6c720fe1a686724d26a6cdaf3beff3895dac1d7198e08c34a4824523aa5febd15c76b7aa14ab9e82bf866d03a8d0111652c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
2e53b97b43883614216d256f62bc5661

SHA1
bc536a538a51fe777e48a45ac2f8a52f1065580b

SHA256
d12300fc33ae09eb2ad04c60677b8537b535e10dcb98d0d53f46a01da79c79b0

SHA512
b1789717a0bb3eb17bf758f81da2beef651feb56906ff4954f415b0a497cb3aa48e2b1313116dc1c45de6674caf09aec010d9c798142f1759189e042eb4e58df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a17421bd0927406ff85493e5c4b11041

SHA1
df4418f9762f4c4bdae19f5a9492ec456b62e8f7

SHA256
fe43a37fdcf5fba0954fcda7fb2fb7a98c83ed8f9130a0ab5f98008353db8b6b

SHA512
576a7d4e7228dec41161185f115e1524e719a5276705704e8f992c3080943e57bf0a65cfc692f928cf7642628912e334acf76e6c8af131ee1d48a26cafaff6db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fcfadb3d52f98928cec712a4afd0b266

SHA1
29f447b45dec3e4048f9da0319a30e3569ccf4e2

SHA256
3c0866663022038410ed7c28b2f178dd1fb547418f0fbde187557f8015cede2c

SHA512
4acf887bfc409ee716d8d6b112cbf612b3aa14eedb2436d0dbbe5bf6609dc60e680b0214379b3cfb7be00ab21f22734a3e2ce363a5329800d64c810d44dba1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
865cc4899852af5e77735ff1fe43bbc1

SHA1
d6d0f45227b090187f968fe4e913baf6792c213a

SHA256
56c876d726c57d25b43cd9097d423519009509ce93ae5d95c46e46590597d6ee

SHA512
08e7a8963b7e864790f03de373fdfd5747f520d9e0566c62ed43d474f9d56eed70e8ab6f358140338561f195db5aedea86e9ad0db5092c35488cb973c72a6d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
09faba6b3d17b356866834d5cfc17935

SHA1
965a5752e17d84282d34d106dec34fd7d5981ec4

SHA256
3738e08030bf822960539aae77bd8153a0462a8af2c3e9a4a5df22019ab3df76

SHA512
9710be9ef0bd72f35613bc86dad812ed0b6e11dd0883e72e5fe7fe2540eb6abda88ecefd78fb4185f9533b9a820768996ea6c5ee774bc5ef042a19dbdb1bf665

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
e6cde797927c201194831801bb066a75

SHA1
02a27c515c25626f07de1cd0ad8c47dd5ee4cec5

SHA256
1cc2f462fa226a8d75310a0711e9a562cec89a746cdf57182ae0eb87446b128f

SHA512
d3a984a6403da16c89812e8a088b15c97d75fdac4d0da39790b0f662f70fd2209147182b781b5f70f7babec491dfe300507deb14aaa90288f3bd698b1824f7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9399d0481ef01028759fb9441b6cfa00

SHA1
4fe35877478e47e28d8154cc564bbc1775c2dbeb

SHA256
c46af80c1e6e4a464d9817c5d0c3c3d5cdec647940d9f55e727adee25a8a1ec8

SHA512
188c3f61d921bbff852141e2febbfb264b666287529af484b9d55d6a1c30141d09434f2b18ed9169fd9268285c61c83056f94c39f1dd94c3b55fc27bb8cda02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5b245e72cce2f6182638424e30aa321c

SHA1
8e3a3354a1ef77142ecc520e5803179d224b0764

SHA256
7aa0e5a85d893f2b379bba079c7853518f6e11459e171e4dacf5011ce37d1b78

SHA512
907bff16d05eeed31650322afcaa5539cb7c3f53f07b5657026dd9f7a85a95e18c3184efe86b1eedba948c314bd6ae4c5161afca15fd05d0eed1c2a8129f4952

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
525e5d5ff17bfc36aa08388e9f2782c3

SHA1
8254e8e2b1ab65eb00ebe042b733d4abef78bd89

SHA256
0e74aaf9b47709e90288bb828321afe034a03a703b483d12161cc003de9d3d36

SHA512
3f976813db3be650e8d911aa610668f51afef4152ac8265a2f667dce1d3b4450541c077188fab9aa9dbfbf471c13f14ebbece789d643c5509e32287339845646

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
074bbdeef429dc8f219e6dbb10238858

SHA1
de2b05b37b4a7e4355ffc4a5c81291812ccbe7cc

SHA256
6857f333f4b1251306f90042fcec51f8642d076be0a82bce20d72d983dc5678d

SHA512
f2f0dbd2b45173663c480ad963e00ddaa85b0d70cfd2636bc34f899cf7c2dc5f41b12db321467eb9668f620a5a0d13388929656a23fa3818fb988b9aefe915f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3c12d24358283a76154942fcc1860f29

SHA1
891bf1b4aee8599d57d5c3c959f58e34842d8bcc

SHA256
167651cfcfcef99ed4ddd8a8e440bb0a9b560bbb8a13d352fa533ab8a88a920f

SHA512
aa14f7c93889908236aa7252078331d8cff4b712c02669f77373585bb0f5108690aee42769d6c8ddc65f0584f18f6f8387a090c6ed4598e2393454fe3f857603

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
072dbd1611c7cf7f0ae239c78ff244ed

SHA1
478267001686fc8bb39ef22a8c8fcfe29f73cb75

SHA256
c1e9209142f3cf551df7faef319a59cfbf10b66c8094f8e8c1afbfbafb7700aa

SHA512
e2d4045a6c3ebaf00dbba6847124f4e478383139d02447fb0cfc783e1b5ad105a1e5e1ec1f965a8c6249c1e1b69528931544fb6f14a914fbae8e351f2b53d6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d01600adfeb4ce0028fce3080880a16d

SHA1
276de72f75e7da0e54e934746ffc8240782627d0

SHA256
ff74a5c58c235d111df97b00505c3a1a2f367257bd7fbd4116534b85bb91007d

SHA512
346e2c73c21de4bb65ad711eb9863135c1191254b83b70247bdabf08662ddcae135a098e30802988d6a33759d7c32a44234d8a1c8374af340f89c8e9360f9d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7d5740bbe7fea4e8a9a87e80c09068b5

SHA1
a8aea794dbfae708764d76a6cffc1a1f91d89604

SHA256
e24ec888ef41355a941a733fb1632ce2caed16b4b18efe8464febe52bd6b460f

SHA512
853310619b44cab218533d120ce7deaeed0a3ee7fbede7bfee7fd5a581ef1161378694a02c0f0ad6e5aa0597522a0167abd9ca218938a456b1252634c4245ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
2f4befa3c7396ad5841821ec27f1d9a4

SHA1
8e670542614ce2beffcc61048374a3108c820112

SHA256
d43112b86b52802a86fb7477acb96041f105edecf67904db3656498cc5aa4f61

SHA512
975af9965fd978c0557a9e92f33b22a3555fc5c018b68f87d274578466f9e0fd98d531083d96f622c70dfb9657619c3de933196aabbe79493f28d5d8214d3bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d215aee2c01c0a8fd6223a37aa27e9aa

SHA1
f1eb59e5b70677ac0e3f47737abd4a0bff9ec336

SHA256
262d52e3ec5316be05872d71872dd4fc0504bbe425577ce10be4d2cbf8039212

SHA512
2760f77b8b57d109bdec6c7d05e9e99ceca1bff8d6d70712de4d38bbb4bac0344e27a75620a4707ebf9202d2bef30fa0d29e1d57ad9a6a96a2e950615cd5a8bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
63101f575c09260935bbd4b56e2677eb

SHA1
40db108e3df487520ef7bd25460bda0bdc6ef3af

SHA256
541ac0c5042aeed62cd6779401d7479471c5cad7fd39c7b466c63b199f009acc

SHA512
944c0887ce09e7688822bbbc24d06bef12d42bfbd577278ea5b129fc8692fd4a25ac7d9ff8062f1f8e59ae7271a33c94dea3503d578e190281af0c4092da7e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9a21ad0347b3d64a00051cbefd6b9f03

SHA1
8e20822a13067d6a1a2918742d7e2496883805f6

SHA256
66572842cda2d6b4d734df95875b95185cccabbd18b3fbdc246f07bc4dddd4fc

SHA512
3d4b186a8e9cd544a33e28bbcaa68976163b9b020f8ba479fad0829dee09c76daa6b5be53189cc9a1e7e7c74c765b271b808ec011858b20a66736216b20e29fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5e207f8cfde553ab9eb6a6429bab9313

SHA1
0338187dae2c6ae42e61dd948485b783f0d77847

SHA256
1e2c5e71f91a2da23b703373162b724c6c504936327604f5ca7884b0a963dfaa

SHA512
a71aec5da4457a83677e0ebf2e44af2b1a026c20255624d8014a36cf714ad566c1cd347270008675bfd3763869a73246da00ce25ecc21a5864b9286eb53939b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a3aa7940863a98cb50e303611041d650

SHA1
b4e5dea21b4e548e202101865608eaa196960ea0

SHA256
27854399e843a27c00b3707b2441f6f988160479b0e29909c57d9c4b8755441d

SHA512
38cf652c22bf31d253af380beaa908a5d6632214d806d9b12be3215ce3e062c6aae7dab0840ac87bdac60389fb55918970ddc42e9d5e6ea7249afbe407d36337

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7d96d32a794445ce20f345ac789924de

SHA1
3e3fe91f334879396b0c5b18b7aa2d1e1d5eb557

SHA256
e445a04001b70c39361e006d8b711592b20d6ccfef8ec54ed3207db462a29d37

SHA512
f30486f1e4c62a34a9c48483a33dbfe999b558b4edd7c1c6380248f4b62cde913ddc3a0d8a20d4cb09fa564acacda40f81b3bd5d30415298f343b91a9f1af779

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f2b19df65f9de72856ad2a7886064492

SHA1
b5e747bb1b826bcfc62a5ff8831bc987a24e432d

SHA256
613d69907658de7eb78c555da0aaee4ddf1e9269508e1a4163857410a4c0eacb

SHA512
7c724e3cdaee58413f0a6f7cb4fa72403f4d82246817c0b9476a325344154aeaa2cbf8caab17fd43e95063a8eef1ad4f2e16d4f3ba6fed1f293eb67fede4d833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a05a4efc0f5d028c800533ae82469c5a

SHA1
58ee3e3d18dd14d34687be376c98252b1a4aa736

SHA256
f2501428f7fd3c44525d475765a257414660bb2396b56aed7e70c4a7d232eea8

SHA512
0f791d90aa18e8c028af19be787e4c7377bc62a6c4b5ff3ab0b2afe7c5b4fdda84a997f3599c94c7c9eeb9002885d5d827aed4e04812166b63d432d458ccbc5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8c905a9830d9b58fcb099202accca4b9

SHA1
b2c2791965dbfd1ecdcb41c6c12eea1b4fab3bd1

SHA256
8dd1758d518e42ecec85a2a0f0f260c97cfbba6e5e154981c0964f20e34a7463

SHA512
02d77dcd769171a7428b64eede27708c4947604cd6b7c9dc896f75a4a936b610c06368b06ea3f2fa7f60dfd88b7fab67e4a98a7bae71eef87d4f3ed90e0c2971

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4650357e5553a76c9c000f46d9a89802

SHA1
7b536bace56952b7aec525decc2d02e4b16b6601

SHA256
1721b281337bd73719f6e9786b51b12a0bb6ffe4fb5f2a1d5454c1922912b9da

SHA512
3a4e40597f25255277bb7b86a3bcfa3aa35b091b15e16831c9b4821bb53b875d8a12a665328ec6bcbcad0ef059ce3ff79fce534f07dc294698248c7a32564715

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
40b9fb85fad2521952427c3de9d0ee26

SHA1
acbb2e55501b54838c2c6b0c74afb5cef11e56e0

SHA256
cc69b0ca75736aa21ea79fb65e5d9d4e018025571e44b6513435baaa75e942bf

SHA512
1d9011a827fab9513af73f4b5b0934dba3a88d79d70ef079b7367eb704bd99b2d6da4ca2f58c965691545869a5ee48d1140f27f75aa3c968c74654f333fc1813

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7700f12fd1ebb676e4090cf80fe2fd10

SHA1
0450d1adb4396311eb875b43567dee944ab9065c

SHA256
45dcf325ad72079c5e3ffcde7c13a6d1ecb358634c7fa704a299e249ce18cde5

SHA512
d607447ec691562673262fe61ac4c90890242abef583db2993d26870cf9a374cef53f7852002ff4980afa1258f1d471b7c2443390ada94b38f52ef4c1906c5ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4402f7f1b0cd754a51a9a1c4df9e6b52

SHA1
87f99cbc5a191195618550dd6e4fb98f025205ac

SHA256
30573d114ae19d0674be93ff5e27dca652e3ca1d55bb733dff10c999a97dc330

SHA512
b2bea070fca897db36aca2dd52f14a57ed708ca7a798a893327f78ff928e5933ca2d9678fd7d514144d53a3dc66fe3907a95fc89869c2278a7fddb77d70d11e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
b845ef1a26102f43d523b64d54eb8f0b

SHA1
5288bef1a5ffe0632e8a33a4d1d64558d0a82508

SHA256
43d62771ccde84003dfa4db00737f54f7328695811475fd5023b3ccdccafea51

SHA512
a5a6fde6c1301c4ea91113b2379d7123fe6e9bcc38e8382d611ed42347fe32580a6a461a986c742c912457160bef6419defb4f33be6c45744db9610d429ae1e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
544d0ee77be6cf4fa167507eca265d9f

SHA1
8976c340785894449900ed29ee280b427a63c014

SHA256
779c2a925113b49c4d2ea2eaa20d5c23d9194d8b3ac98d205e7332e9e74c6cdc

SHA512
18f5b8229c6b7f7971973df91eb326780e2a46aac79059942ce55dce07fbfea21847960aa0bb22ea6dc4fd936254ac7223a71c57ea101611b8f7687a054424ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
0e201daf362cebb99f2e0ac3739b8c87

SHA1
c40b8b6c2fcaaab9b71f2aa430aa42a84c645270

SHA256
ffdd09bee41786a03c5b03ffb97b2e3d9d0b64771cfb0641597214d447896ade

SHA512
cfbc926ee1f1e4a8576716ea757f3fbf06ce22a0a3e9ef7fff9196b243efd0e40a6e5e87b6678122e7d73cf02a2859f0bf6e0c80d4aefa946fac34b5ccdf93f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5be692089d2579970dbde8234173f0f2

SHA1
6631bbdd3723be4d1fab9e063211d36e48ca6d97

SHA256
b3efd1710dc344518f7f965b94ae48b3a7cf7a090905a3fe986a242e316ae739

SHA512
785694f88846d8d3c96505716a5ebb8f25b9b761e062860e225db5a2df12b5cb8e98d8e91f79df5c8c88a81e478ceb0c32983d16cdddd40e4d6cad790c3e6353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1e51775bc41744aee305381acbe697b4

SHA1
323442cd1604cd4d726d9351c0599019e90ff825

SHA256
adbb83b95e3b8014b2661fadfb8d6721797c7d3e042d798e6ef955a3f3e91826

SHA512
7f8a54a8d8ed0380cdbe6bbc380a8fa6426d6d34c2f02a9d3bf7965174a4f7f25e83eb4059471c74ae10ae041d80d1a7182a395378000979b4fcabeff4b203df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7ade09087069e86088941ad339ea68e8

SHA1
4e58994f062befbc074a767649b19a3e29d75d0a

SHA256
57ef4714027b076149a606a6e0698a278ed1426fb94fc827dd1e3e953639bb7f

SHA512
5ea6e060a7dd1772721d8ee2c59e407dce1f4e7a3f43fa0d3787b98a398e87847e5d242ddda521a1c734e04a6f35e6c37606318622ba12a99b11d4268014ef72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ac5f56ae5d3a386eee8e4dbc15ea4d2d

SHA1
6da07f7a6728b48a06d71c5ef324c883d3dcc37b

SHA256
f6ae01a1ea3bc2a98444bdf67a3e4349e6245bf1aeb3268e92dff8be9a74da7a

SHA512
184a8e92f0c976d927dd60c977d2de8cfedd0adb214549306fe84213ee69145aee5160350fcb1fb52eab7bb1fa6ed5f7678d544f73126d2de13d6f6bd736d8ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d321df138d7cfff73ec7d0230b369556

SHA1
c2b62b11249305a3810298fbf367711bd7a75b5f

SHA256
5b8e332c5195759f59e46c97e4c5c705bffdbc6da36f459cddb50f4b794f25e6

SHA512
d666106f545b343c135efea2c784401aabc1008076022e40c90356f16c051c735c32a6f427c643a6050281770e7f7a10cee2dfdbdf7de4ec0513eb16d10d560a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ea85606f34a0bf4dc1caddac81218e52

SHA1
115c361396fd1d9499f6663779f48a4f8d7da20d

SHA256
0221db7f94acf39abaefb0b6a5911b2e9aac6a15f687b24c13ca08806ebb8325

SHA512
832be303af6ee5752c478ef783846f34e1009014c8492a4d9c5317d9339bc712d655da40c6ffcef06d4e557147e5988203d5fc5268ac974fbf27d773bd2849d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9962662cf63713fe4697047452d61dcc

SHA1
116b92c18dae23d0a72a2da61c717fb01bb07bea

SHA256
de900dfcce9e605c05fa155c173f0253c74cb36030397d6e4165febeddb19491

SHA512
fb8d420340a749b2997b0ea89e9f96224dccd24d4351405ebfdda502d038e31cfe52bb913d87db31f492794526de4b88437f20441c3d2b7deb0a54453b73bef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
467aa9aa101a82529b540033a1f94724

SHA1
dff7a5f630c3bc290c0a8a049db2d1bdd577ffa3

SHA256
15bf3e8b32d7ac33ec967696f6b695452eb079e943852ab41be6efad6f957ab9

SHA512
d89317dd55ea0b0c472a11cdb4c0548471265f96d34d9b3b2a8cf70aa2ff5e8053bface92c30eb3ac9251e08c7e33121fbd06d6daa293b5117bcf010415bf07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
acef02f4a32b9ed870ca01b3e77f031f

SHA1
6189599efc5e836b17009813a90e5a1eb1fa2de0

SHA256
7f3c016812fce64df29822607906c556feb23295e05d1a1631f22ac90c995918

SHA512
83c3c6ea3667dc70e068debf40db2716d0532541df1968322f7027a71a4629ce5cdf21ccea42c7c8c14fdf1e0369a24656a19f30c61bf61f73ae725e73ba911e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
076e139124b20b11acb283fa0782fd2d

SHA1
feed2566659739130ba4a88fb8a425df9bced4df

SHA256
cebdfb46299f1fe1a34f4b1658817e93d25d330a2cd0ec420acd9e2c7940afe5

SHA512
a513b35bb91bf065d1ba22a2902706e43bdc5354d8c640eda07b4faa52730c98eff6ff03b09b70010e4e9041b3fc0813f2bf54179eacca9cf58f1469b3b7dbcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a5f73e1ad1dfc7a583cfba940d88aa0d

SHA1
a6913a8ee964d8362627a52b789e50146ce917d2

SHA256
ada7ef203ed9a49e950830b88ad7608d1772c0603c16330f9a38718a67ec73a9

SHA512
c89a29b5433a05f245d8e57a688a2a2b9fc00922a4f75527b4e8b1d5918afbcd6a6beea78565ea446eb9bfa5eb30115a160c647c4a06ab2846f841c6b6b1dd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f0775e190c2dde89c4417f9339b0cb60

SHA1
fb04fa80fb20dae584da1f947c416f1da5603012

SHA256
65c37ce8bfea6d90c9c9abbc12e8b77cda8e262dd1e5de77e1fa8c3090106b23

SHA512
d804d72d50731e06ceb67a5cb9783fceb5de6548c95892e76dc901955a1d8b2ae5a7ba92b46278d0c3a611919df52cf72ad899b796dff09dea4ef631baac8d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3f857e2935afd2c53ed032989f4f782b

SHA1
1ddacd362026c7274b8fd1920346276e22c18008

SHA256
2e5bdea154c343481b058f8e705aafec01c05b6fa914457bb3b601da390acfbc

SHA512
e28a99d483911528ee20b974f237de75a7c30a34ec770e30e6e960334099a99235cad29f3e6874ea995cc124ab54f2ca02e43b7f702bbea4547453dafed5f9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f9c4cd115cc167c084dfe63346b01f87

SHA1
7966af6529aa330d767e1a41b50246913727e301

SHA256
e5a5d6fb3a12839672519bfad925830c20bf14ea5ab4929e169a1d828d5523b5

SHA512
2eef3c12e1129a465b50fb1c0fa933c57b6e5a1003b9090268cfce93f2a014497d86548c3ec985efe98719db5951c466389992bb7a7024f01ef58384b4223ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fbdd6fee77c2f96630f5c94972980069

SHA1
44c6e1cc02469b0c0d8a7b1422bb7f81be3a1527

SHA256
65ac23e96aa947e22a12cbdf6f48907b76fc40579ac5f1b502bea78cdfad8a2e

SHA512
3f2e4ea26a877630a7a9c837233e19f7015abeed94a0d13935cee90ac8adffbc7a6e679f9ced23d5c145809d65759e2a216b3c30f29ae51e229f14ad7b9dad44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
75dc5fe8650d28979214a4743a30e3f7

SHA1
4d3506eb24f2321ab7b5399ba9a425dba0c516a0

SHA256
6f7a07b401c2dfbd720e9f2130d8718b1ee3ec5091b90dd1c99c798bdd95bb2f

SHA512
83aca6aa640ed67fb0a019f373b69f89ebf376a006ce8f10eda0792fa837fefa8fb61af639bfda87f33ed4f9dd1996fda2aefe15c6a8dc05d0de949a048d2d2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
dffc41f1922c54a91f254a0605b9fa7e

SHA1
c2c1259d8fa7d0ebd4c36daa122c1722bd9f2100

SHA256
dcd92b68209fca84a89429a0f5b222cf66aec2a63f3af20b2913ca548727c294

SHA512
b5d1cf00f9bb43809a5a1f343f74cec19dddb189b7438aecb9ae7626cad6d8eacb8db7cc2fd8d8c047a07de84662802b8a81d988deedeb93a76893530de96645

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
e3b6acd9b3e4b6f82b95de792fcd2a85

SHA1
ac9d5abc60a175482e143fd7f9ffe34784235664

SHA256
4c8c4a3db1e67df8069c489bec2fefea2d34cac9dd1a2d4b1a6566811c8ffa91

SHA512
4bd8bb202cc9b0d1941c2a6b3d1c5431a64c61a0d742fd40c889d61d1602d92adb396c1a25573baef8bc50edf865e969dd63e8ed95b3adcc7bc3e6c43f6f2281

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1312493db22a076ce8251da8a9ab4026

SHA1
61daa1281e5be3d1abf87631a4b806956d239b10

SHA256
2655a6dad070b1198bf1d417e92023ff13894a38a108527d05fcaad3c874321f

SHA512
74aecc50fe5c6383e25d611ef71ac32ec7b3753a3d28d00b5b7ac4412c5f892dc1c1074882f554b4946482236f664d68ca1e6d9878f10e9961fa6a859e89a0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
c4a28d6340e916181fb5b2a564c60a33

SHA1
99f24666ad7781f4fd8b4e5a8f4ebba155f2aadf

SHA256
e5b96d4653d79c285227beeb632eacd8d7d59ee2fd1d30c83bd35527cc55992a

SHA512
15b1d6ead387a506b43a7b3c612e1ec6e5427594fee22f393c85cd0a5c3aa4f357c7e31d5a9329bdf2c8773ff986fd8e6667182099c0730443fe26074ea4d39d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
c8d15b416a9dd22b9ca71ea831a045cd

SHA1
f502e607e2d2401247cb2be1fe4ae07d71295870

SHA256
e6563404bfd6c7b0b3fdb8e9ef5308fa1c95698008bde56cc1eba27801f6abdc

SHA512
adabc6cc2cfca3d0074e151cf9223365bb91f3278b7d32f0825366ede30a1f306ad937943c214c9e4a52d7d83ece94d83868e67d6c880067c1337890ffb9f832

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
303d6c5d4839597d58b1ed4cda89e86b

SHA1
e20418443b023ea9fd88df0f0d7b44d03565baf6

SHA256
38a1ec6e57c9c231b956ead1eb0b890097188b67d1fac92b8978b0235d299eea

SHA512
c4deb2a162db6db266f8346ff1312f54072a0113ff980697f15a3a022baa4042df989096f07e587671cc6368942e7731ab14354da35eebaf739b493e6a6a9de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
b437f188dba9e39d4c04f2d9c9dba5ad

SHA1
5654a96d5c081d8fdd4fc0710291e11b10f8e887

SHA256
161252a8b872454d5670d62d2ed7fe5ee1e94807491609246e8c7a54f80013bf

SHA512
80a74a09feebb63d9e18f05cf3a19238282cb76c9e7a8331d1575566307ce8754f009780030bd11a113ec230a762f4585d5da8575f9cc2e6fcb5f74236187e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
82d36e5998b505a93937d7be455c4589

SHA1
95709cd10baa4489a17c2f134499a5627b53cb1b

SHA256
3fd5ee0db48776546c9add328bc1814f7d12bbf4cecfe1360f2dba93bb7a2b7d

SHA512
a194872d248eb7c7592140febf8eb97852bebdcfa5cce72b0de45ee30cc9ed19258885cd38d735bbfadfabac43e430311d10b875cb286729c1275c9b54ffad3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ec943cd82c33c1746b591b6ba702f740

SHA1
7042fa0986a6c49e8e16eb6bca820426e16f8877

SHA256
89e0845d06481d4c71528261b836b9a17302a603b8e6420947ab4e2252af7d30

SHA512
0be03230dd9b20fc95c6e9e2757fa38fbde6ff0faed717351aa06614aa38dc364ea7dadfe49f438d7298bf155229cfbde6858e5dcc67d88bb92570514da7b016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
09dde408857ada081af26341375245dd

SHA1
cb0b9a8907aa46c3e64f7addbdc51821dc6c3e68

SHA256
29ed09b505ab995af1d314544aedce5a3bb4b4e21a6600686f2689a7271cc5d7

SHA512
9abf1cf4d60fdf1d9156bebe01f8c2180e1951e82d264f0d773a2fc327927e8cb672f5dd6b8e947745b2d1ca24fc916e26d234aa3d22b1bf57cb05a2aa8aa1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
694fedf9a7b4ba7bf1c188f56e2f54a9

SHA1
b026127dcc2cee6e51e28a16704d8557460969bf

SHA256
ef1405e0e5eb7970bcea0c918ed9612ba9bd4e042595b62ad0255dcb2257fe0e

SHA512
b4b9c704fc4c25fe188aa227a9405f37506b77a6cfe08aae91c0188385f69b7e8f47d2b00a092b56ca017ad9acea2b1a23f71ae05e4786c69d77dda70b01d61d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4baed092ffa8e69ce402fa7043f72617

SHA1
653689ac9e00b16cd8f588a0a49fad86fe022092

SHA256
c70746b06477782907e7f88bce9248ea20384f1b3b98aa0a76c1bed584e19679

SHA512
65f186ae0bd09254ea7f23b2602f5c11e006a08be95e8bd8d50c9697241cf0c32e309c50f9d86021b39709607528bf199fc74dccd41c2e56683397b28511c19e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
6aa405629ead93a7ea8629a845c3e614

SHA1
19a1a694b800dfc04fc10bffaa60ea7d74ef9679

SHA256
67320938883f591d9d26cf29b9eaf7ae2b4f9ede66562a06191b52c8af20efa2

SHA512
7f6648953927134b9a2d2d5962b4cd135311fd93a9df86122e5a3b262bcc1c08ae0ec4aa3bbdf28597cf4901a23fcf2d36b7e62fe54703485f6260a57f0dabde

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
2987bdedb084ad0648d7617e378e4966

SHA1
71e061629fee56ef4d176ee85d015a0fad6a3315

SHA256
86e7b86fd0f08faf28ec04c5f7620133cd19bb53547f09a99f432dea2e3dd5bc

SHA512
707a9d728c6004a24081f0334eb2f46d12fa2dcfc32e2b2ba43137ad7582ed353f871c1233e155c9cc3b50d55ffb83e88fc7f6868b173f305ce49d9eb1845faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
33d939a83117cf6dfa8f5561df6d4ef0

SHA1
8592ae28b1d52866b19aad24e26b8c3eacf43835

SHA256
dd2e3f6d94cd85451d7af39fedcaa0a96097079b5516a0c8c44d82d59f8fede3

SHA512
64c4416aa3714821c04191472644065cf1678f929bf094410cd4d3e19e275af6fa3a151231ad8c26186916fcd89fe9a5618f4d9513a45777005ad4057947cc23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
a2dce4ca547a72da371feb22e2022334

SHA1
b80ffc25c78a24fc86e5fdb3a630b14c76e7c3cc

SHA256
230731edfe02413da02d37b6ff55140f33144f2605aeef6eb54a9a86e20ca1de

SHA512
0c605a9c819d8414000da8510ede7a48ebe6a97a9d9d391cfc1fcd9f2469b393286c3f7b31e493c559aa9a6ca1eda3590bb4b3f94859e49f8e461afb13326143

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5b39377d5d94cb9f20aec4c72bb314ff

SHA1
712ee798b2160b0f618a0def5cd33eae240075bd

SHA256
23a5b63e2f2c4432a20e858214dae32ffc040f027c33e0e5b2356f8c440f8bbe

SHA512
154ccca70cca0501c0caf9d75c7e855371ba061950c444d5df3baef89c37bd5f425bd7bed7e8ef1e8f06b68f1e4384c9593444a165e5e3f77d5fe0b76b5f4f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
29130003d898f67d08afcec89b2b331e

SHA1
46c5b4ba05f453d5a0cb75cac62ded7fea117d4e

SHA256
529279be481f2ce5f6b67f39d67447d454ab0a7f36f7041c3b01370e23929b88

SHA512
d033e62f0ae9283730355cc7fd465b006db33faecebe2e75ad5935bc5f184047f99724f898294bfce4e9d2ea188ddaf97e26477d2ccb6914dffab7c90bb2f283

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
bc9f47716be777b80d7b70af0a8ae61a

SHA1
a060b25b39fc3147beab6cb80e38abbfe1585626

SHA256
82f29bb84c0846b937427d211aa0097d09b81dc99291c4ecf2e4e14447c0d539

SHA512
bf3ede0f6e5fcc8ceddd884d68284d0190d26e29a722ecdb6d3386f73c8971e25ceec96c8173059f509d1db7b85fd82fb5f0657301f561690cbada3a601b3bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8c31146e9b2691775c23ac68b834745d

SHA1
74e6238096d67388de493ae54ff329a2e5a97317

SHA256
63debbbe57dd369f5856b18157763f2767f0420757ca6e133a17461a67c4e43b

SHA512
d60dd3ef45972ed1f1d39033faa12e0b4daf278a2c8671de5f1a985b59bbbfa7bf864ccf04e2d6de2e7cb04a8bd3b62fac2f4fce91edd08da1c7b2c7b38e55aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7f9ebd3acf3bc4d159764750340c273e

SHA1
0fc9d4197a6845ea4698af69fdc4789df463e4cd

SHA256
4b30a088ac75fedaf5f8451b0c34667b28add95c59225eb5a1c511ac030982b3

SHA512
4a0746b9965ac47919dc507b99ff86ca07e60ac454f921efa772d55d4d367430552eba75025a5e5c51278b9504ec5a6a4d83f9000ebfaa2ca66efc0fffdda2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
874a9092cf219bd0ea505816373393db

SHA1
34c0411e82fd320fea00fc38b69f05d7b9f9ec38

SHA256
ef932d341aaa326c72b906e4eec0a94a93077bdc6bdf141c6526b66096e1753b

SHA512
702926b3efaf8210d54d9cfe7fdcb4df8f05ef1314ba6c9086699c2cf4c307f78879574b77ad1ad988b66982bfa2fab21d71b3ba29dab4443f72e48d91325fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d293e62340be5dab6e6d3cae317f2980

SHA1
3981730b23d257d5d0afbd5852fab59f45da06e1

SHA256
1c848ea9ff3ac46806fad8209f44f8f8a2d199e8cc6dbaec4e10599fc3b65068

SHA512
47b8fa7275497811cc477334eb68debbb391e8f18f1cbdca75e495c8232e81bb0dfc781389b598d309770c21f36925cb2bab32e102b08b2b01db55a7f787b9a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
754ebd9324571b9e2dade489914943d5

SHA1
86164f804f067bceaf49c4e679571dc15736a522

SHA256
2eca1e22c8443f050e069a0921fbe4bf031162842ccf7a277c1b5966d14e306b

SHA512
7dcd82a200dae180b75e30da959108905f46d514bb5078d0076cdc0830954220479067145fba4d0a2aff4c95208135d102afe596a66189f49aef653c8a94b98f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
b20db8a031c7fe7d84ef861d8428f67a

SHA1
1fb28b23631b1d7cf5205d2f3083ea0dea6a4a0f

SHA256
baeaffde307126a6fe39d7203659e7521273c7f888ab9409b9f2b364bdc8f581

SHA512
b334b0d9b5a8ecd2ba78c8d7c6e00098745fb2cb80b71b75b4fe9ca32cad7aed5f999ca3403a024ceb21b2b8a34e6955d919803d67caa575eb2166f60d5cf8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
debb2446a9efa4c008d9af07b4920912

SHA1
9181c48b9c476c7de169730500cdebf4cd76405a

SHA256
48518f599ef1d3c98b4e61df92a76507111198dcdd9c896602e0b494f69c7d59

SHA512
e655e9352da11131dfe76a2e789321ef59bae843d7f6808aa1d9ab70053bdd8c661bf52b4a3033bb0dced4de3251c85b5f884013cd55a2502ea2c1851b0854fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ee7cd98e7ffb452d05adadc8479261a8

SHA1
578219f24f3e89f3298ce05e9e5604430f126024

SHA256
dc1aa0e27aa6ebd8acfe7ff182757d9adf226d66baa4c46f60619cf6bb35fc1d

SHA512
4445777431f793242a383241e516c5fa82cf1e919457c57342752af36c48db6cfe4ade83ec72b33781ba2f579f7800d494c2bbf31fb9d829ff612e6b838d8727

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
c8971b74a233c1174bf815803cb915b1

SHA1
b8f101118dbadc905e7020efa110e6ba6fa7ae98

SHA256
1028f68c7a920d381cd18aa07cc7527335c3cf35648169f310223e8c46cf6e40

SHA512
f9bbd0a383a05c0c1dc58a287ea2e6c6cd288ee83fd003590464b8f188249d6afefc78f7ec20c6ea0a38ec87864c3ed8db962d47b16ff59d3846b5c79d244fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
285a0327fc4ebcfa364dbb4138d36a4c

SHA1
fe7fdc679382c0750e15bb954bfeedd2c2cb3d13

SHA256
98467c7f49d9a7a370bde35e396696313c8ae21c7d82925eb688ce7ebc0d9d09

SHA512
a57108df1d4cc8f872a4852350c2ae0fc9366bd8b550236dbb7031b023c08aefd5ec1723da58c0641ec112b64acd1284dfd867d91986cea09d92bfd119266f55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
cdd2177618a8285a9baa281d9f887104

SHA1
995eaa17eafbab123870286b9a46826e7a0e7b73

SHA256
84b5c6637848b6dd3d4cfff3798c4c0378b26f8cee3e2e0acf6717fa10379abf

SHA512
0197b7aaa7190ed3c177159877b833b2f6efab8187938d2a43f3b1c55a542ae9427c8feb0fb4a209078fc33b4944b4ae5e77e513f5e5dee11d84f518f25d3271

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
43c6efba142925def13a1af3cc217ed0

SHA1
f1b2fab6e82ad6f42182f8ba17cfe478b70ffbc1

SHA256
0288fb387468b485ef356a07e0c54f78426bac53c48dfd365590b6556e90888e

SHA512
50ea1601d9e385fe3bff6ee01a9e3fe5f82218afdc69dfc7b5f115aa611e50e6cc48eec69bd86f467135b0e91b2d2dfc3dd2f31508d7defbd80ca7d7730d7c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
0721323fcc31f2e73ef04360eaa55a36

SHA1
f74cbbb41c5961b01aa6333f4b9ecc2bf43d0aee

SHA256
227e2c5ffd23361f111bd014f75347393e500682856a0f66be21b596437b239b

SHA512
3595ff19f04ac63fda84866da7720da31e4d472a0804bd9f6dcc87a9f5d020030bd6733350fce87fb7154b3cbcaf5af26c1c549082c7db1bb1fce7931da141b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
de5db24f1c964cca2144ddf1228e87bc

SHA1
af1248c1f18d2c4ed007e619341dca8b8c36bd17

SHA256
07a73bbf25d3cff63fde0b9be556f0bb6777a05b6ec9eb837704bf4b79d41ab9

SHA512
99d30727cf40d148c627beb9b5891d15698537000784be0c69c61a996900d1318599a7c5af40866cde7ccaf0adf9b48f5c756c0edfa0dbe67811c633920ef66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
458d5afd9fdf19c929b40c4a0a511746

SHA1
5760d14a47b10ac28be3d19d69acf67d2fec3638

SHA256
f3b91b25d18e073edc76868995054e9db16751b1d16c622ff09a097ff3c21023

SHA512
759f929c44e2fdef9bc5ebfc221aa706d8b2e08d5fa1d3382d52221b7235ef8c2105c71d21c46a5cbe926a5e38136f598a29933455e8bc4a9ce5285160e4544a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4d7c5bcf5a7cc07ea81d4861efc1c6b8

SHA1
d78c2071a9d0a693940b0da3380071a069279b80

SHA256
162d1fe2b9a9c265cbe9877aa75710334fdf95d36ee491eeb3157f6b4374fb80

SHA512
0300814ff5305fa6496f164040932be93593cd2c45510a70f9782353e3b8cd3cdd1b4ff2b1fa14e5e4c92662c774c274974049e697d4ff687c3342a6bcb59ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
2daa02ca2da83d805c88a647ff331969

SHA1
ec7329d3af460cafd9dec6d4b265ce6928a8c858

SHA256
58458a4ea3c3b3f8690ea520dc7d392359558ad17b46b1a5f9ce7230611319d7

SHA512
bdf9d085a5f2947cdb9f934b438954c1f995743fc642102042f439e16eeb1a4a87e391c0103bbf54401dba181635f442fe211d208dc73d14ac681bc18ddd255b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
fc180e7f1d683b1a6ecc2624ae0fcd49

SHA1
b7f133ff0924027805f27577d70617eaefdd6eeb

SHA256
92213ef23e10fed6de05be954ba212783078f5c41bf4e9fe1579c92bd0182b0d

SHA512
5162fbdeec324a39bb37d49e779707c66e1c567fdbd291ec52119972f35a395eb72c7f26fc4f4427a419dc7cbebdaac1649abb212d048e2d929734c14a1303b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
637e94f177d2b913ae45dd6c7b78d36b

SHA1
a5e85b3c5c3dd645069998f73a25f59a9b7c4ede

SHA256
fc624aec167ee3f81872f07454d7426c1a50680f3a1b2563e6581624a2ed660a

SHA512
5db2408870012f6813af8b7146eeb75e67bcc2095182b40aa124bf43ae60568fbf9741368247cbc934ed3e5df276b1a82bced922265224e77e4867abecb97588

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9bbabcd2e2f2c16f4d505b7ef05ec58d

SHA1
2efc7e13cd5f62a962e3e5035dc7b4e8c26b16e3

SHA256
c92a4df1c006d44f6afc3bc452086fce72808545433a4ebacdd2441ecbffde34

SHA512
0eed81ae46b2e7478dd9559a8a7c0fdb5a22cf4729cd71cc4470dc913d15fdd0bbd0a930e6b59c8e398171129f0f3b36d1df9fb419d2e7bbdfed0568c2417295

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
93b2f0bcf407572d539de552b773a93f

SHA1
2aa45aea433dbbb3ef411ec09fc1386a9d464d3d

SHA256
1be345e5798c5e7fc38b8430b7a34e02934e54b68da4191b83f0ecb2ca24840b

SHA512
88152f638702f8e4dac95ceff7444ad0a4085fcc7a4f4ef4411dce224366da45a4c770b90a6cdc5be53be44214cb3148cf02e88dc1ec6131317a102a5c655315

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4415013b4dd3be63b7994a026129a9c1

SHA1
c8cab42d19b5a9da26ea870f6ee072c83353341f

SHA256
0ff4920f71fff0536c7004fa95e6d583b5351270533075d64f2f3f071e2ee979

SHA512
916f644bf99e5f84a804ec9b420c071091b92da381596d57561f1e6ddeca1628ebb9db550f88c35a5d0a2d080d5c0deb411d5e8aad52f7d2d2f39d982b36feee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
5dfdbb72a546179466f71b69b28d80ea

SHA1
315676c9a2a624e5a7c2d38b17b6609a6edb51e9

SHA256
9a78000b82f43b95a3d480ab317afd90c6903218a1fddaa9fc248751d3fa9916

SHA512
76711e082f982a69e104d7daebf85417b9d566e4291682d380c0eefe8177d71f5f76a8032dbaf15218f94681b3ac0e9aad339027625b579bfcebe2ba1ee7dd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ce329909fc6b78ec7bfa7849197963c2

SHA1
a678dbd82e9f90d4dd3e851907e9d6af3667f57f

SHA256
9b0e27ca631c3b3a468d2bbfa54058863ceb8c2d12190a4a4726827605bd1750

SHA512
a6d755238d61d2b47ec18f908c19236c3e0d6e9b83e5931242a2a108dca449f4c7e02ef6abc5a6b49a0c80680d911613d36d42f099a33a05c32a4502a80235ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
537e4c04ac1ea632c2bca5e1431cdd0e

SHA1
ca1715433239e0d86307636f2d71708855552c76

SHA256
d95226e9d814fbe4a36df8a221113edd1f9684d6c6bf06be21372c347eb74969

SHA512
6bd17d721c98067cad3e3e40a092593779bc9991496a6355dd79c56a895e2428da6dc4710a5814cf777bc123c47490b6cb52e582bc8105cf4dc6b863a7c35666

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
07ae638b0ba6d2e880ba1c58dbb565b9

SHA1
e92c8df30eaabeb5bcc77b5160648ba50cf8e8c4

SHA256
4b2b26731c9c77ce3296c1e2a0bd442ba5946b2b38cf29013ff2f55ceeb63f9e

SHA512
bd5aad974467652636e79164d2dc6b0f3193c00ab26978ef9b52a4187742dda7061d3d4c891549058582028677c534b9963da8fd88ca936e88c8ba29806e77d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
33da198127039c4752b8402ef6f142a5

SHA1
ae4ce988267d9224bda436a9a3ad8e770ee9b4ee

SHA256
30a0a97cca136c5e93416d2146cb62596afacd5711a295e361f916eac85998b8

SHA512
b1feb825be64553d9f3c7446f13ff198e896a43c406973e88d810c970c95ec3ee2dea3874b61f4f95744a2d4cf5ae5cf4240c9825f91b083b7e4f5ed06cb1039

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
29908d1be469bcb63ae08904e9fdbca8

SHA1
89401ac27391b5fbe5c8436f6f7735c4841c9e92

SHA256
bd35b9d8ba42b5fef1761ec278b4093df6ab1204de2b8ca870ac166c12f4684a

SHA512
072a5955ed048d5e660cdfff6a37b44cbe69c39e80537ad98fe656cc0f9bbbde43dadf4e678549f058598d86ff2ef0ce1c972c92ed5ef530cabf33024b042265

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ae6e138c10dc3de0c7401a443ba21ddc

SHA1
21ef2c98092df9190b7eff17529636cd581ed0c1

SHA256
5e663b22d201b7e66c3324cc7c15acfed2b31357f26c7756cd64d1a2a115d3f5

SHA512
d536ca737269c2a24dbf01ecdaea944031cf34e8bc55872e155d7655ba2d07538b955973aaf145d561670b639735623bafef4e3320e3dded0bc54b7709c18b81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
8607a555a5101664ac0cc89aef440a6b

SHA1
d63b4c84ead8d284fd66e677a4a19e291bd66c5d

SHA256
802c32ca1d0b16f3ec3ead564f37d138b7c56329ea4be2f2c2dc20b7d577c0f0

SHA512
9eb93db7ddf2afd1e4572d7bed79c5baadc0065439499111badbc5460b9a26f74e9dbfdea3a02003033fca178ff63dbfb15e30636f891f33c8f7461690b4f0db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3aff03c7c7646993a4661e8ec1bbb389

SHA1
56561eb8f218ea8489d7b56e0e5dadf86574cd58

SHA256
2374293a84228dc634c8cc96be6395ca55d374664f246f2a8f8775eac62af7ec

SHA512
a059364a6a46b6bac6c4715ff265733f6a7bfccf719683b14770bee842fa3661c2e6ccfa9a621417d7dabd16453ddaef1ba627bca7ae26fccdbf8a71eab012aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
265fdc59d0f59eeadfc033bb4d86b889

SHA1
15f5b83e58130aa0be839b0a0091ec1be85590a3

SHA256
335ce95d8a95fe870d918b58ad5bcc7a99aaa7e2cad1a11ec2158b03afec848c

SHA512
7815a26efe5c38a9ecfa7818dd209f41b3f20b6d4b90ba551907aba40414b02a977d7d766677e40e300476a185655600316b39a364f3e54dff02628493efb45d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
aefcc01eaf6445489e322ad8fca9979b

SHA1
163bd5f07f52161ff493863b7113f275e9992af0

SHA256
36725ad7b32d5d1a269907e0f99f3fce191b8b0437ecc915d6fcaa9415d95b6b

SHA512
45e401a2bbf4ba7a18d7f620414ecf3c92d91a77422a67d0a44622c4dd74003e693b93c1ad632120f4fb89ac28e17fa4ab67f106e9786ce22b4359a1bbe80e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin8

Filesize
8B

MD5
482878711e8920b3a4841e770b18ec9e

SHA1
de65be0690684fd0db191846b0c291b11436fbe2

SHA256
c19fb3c58d01234535947260e55876ea18ddd240a5c29ffa50abef313f307abe

SHA512
4703e242d4dde2575b7004a97bf8206aa2fa4f15e200ca3cf43285ec99f9e1731788c9c39a5a4a37849afe46b794489103c6a29486d63eb857467540f9440ee0

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Windows\install\explorer.exe

Filesize
961KB

MD5
c67a1c0ea5ae95b146f7fcdb65824440

SHA1
2a2b6ca5b2572b829879b299017ae73119919b96

SHA256
74d7fde66545a72106ec98473bb329fb21514fc267ef5723ac195a0522422859

SHA512
a6eb0735668b8318667b6b5ab00cf603407a511c50534b3324a41f90375346c29907ceae42f507598a31bffcb94b8997a90125578467652fbc27e9462d33ef6d

Download Submit
memory/700-260-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1948-246-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1948-205-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2016-9-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/2016-10-0x0000000001230000-0x0000000001231000-memory.dmp

Filesize
4KB

Download
memory/2016-117-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2016-72-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/2432-253-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2432-175-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2644-358-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/2644-202-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4336-151-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4336-218-0x0000000010560000-0x00000000105C5000-memory.dmp

Filesize
404KB

Download
memory/4336-130-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4336-82-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4736-147-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/4736-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4736-1-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/4736-5-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/4736-148-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4736-26-0x0000000000401000-0x0000000000416000-memory.dmp

Filesize
84KB

Download
memory/4736-8-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/4736-17-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/4736-68-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download