gh0strat | 47a7a96d5d211b986abd32a287c24e9691a81954c2bb60e1bccc193a4885a5c1

Analysis

max time kernel
110s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
Size

270KB
MD5

623ff1aabf9747161a364868ea2a6784
SHA1

169256dc7fa2ff29e3ebe5ae4c5ec933fec9fd9e
SHA256

47a7a96d5d211b986abd32a287c24e9691a81954c2bb60e1bccc193a4885a5c1
SHA512

96c3dfa936a546f25e3f1f8a69401400f8437868f44067e4faf1a70baab2d118cb28eb0a46fc467efbd5d2962edb3008d069338caf843ffc72b52e1e4eb1c1aa
SSDEEP

6144:eOnRyfNFO0HR7Wu55Onn+VI3zMJ79Wm0fvxT6/eaN:eI8fNBHlV5I+coJZ+5G/p

Score

10^/10

gh0strat defense_evasion discovery rat

Malware Config

Signatures

Gh0st RAT payload 14 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023c1f-27.dat	family_gh0strat
behavioral2/files/0x0012000000023c21-34.dat	family_gh0strat
behavioral2/files/0x000d000000023c1f-40.dat	family_gh0strat
behavioral2/files/0x0017000000023c21-46.dat	family_gh0strat
behavioral2/files/0x000f000000023c53-52.dat	family_gh0strat
behavioral2/files/0x001c000000023c21-58.dat	family_gh0strat
behavioral2/files/0x0005000000022a09-64.dat	family_gh0strat
behavioral2/files/0x000e000000022a0a-70.dat	family_gh0strat
behavioral2/files/0x0007000000022a09-76.dat	family_gh0strat
behavioral2/files/0x0012000000022a0a-82.dat	family_gh0strat
behavioral2/files/0x0009000000022a09-88.dat	family_gh0strat
behavioral2/files/0x0018000000022a0a-94.dat	family_gh0strat
behavioral2/files/0x000b000000022a09-100.dat	family_gh0strat
behavioral2/files/0x0023000000022a0a-107.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Control Panel\International\Geo\Nation	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe

Executes dropped EXE 4 IoCs

pid	Process
4480	en.exe
3504	install4821093.exe
2296	qa.exe
4860	install4903109.exe

Loads dropped DLL 45 IoCs

pid	Process
3104	svchost.exe
1444	svchost.exe
1724	svchost.exe
2336	svchost.exe
2184	svchost.exe
4908	svchost.exe
3896	svchost.exe
4244	svchost.exe
1164	svchost.exe
3268	svchost.exe
3224	svchost.exe
2272	svchost.exe
1600	svchost.exe
4572	svchost.exe
1208	svchost.exe
1956	svchost.exe
4008	svchost.exe
788	svchost.exe
3544	svchost.exe
5108	svchost.exe
748	svchost.exe
4008	svchost.exe
2656	svchost.exe
3444	svchost.exe
1984	svchost.exe
3976	svchost.exe
2272	svchost.exe
868	svchost.exe
4852	svchost.exe
3568	svchost.exe
3904	svchost.exe
4064	svchost.exe
4644	svchost.exe
4360	svchost.exe
752	svchost.exe
2260	svchost.exe
1136	svchost.exe
4920	svchost.exe
2272	svchost.exe
3384	svchost.exe
5096	svchost.exe
4108	svchost.exe
2308	svchost.exe
3128	svchost.exe
4340	svchost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lqlub.cc3	install4903109.exe
File opened for modification	C:\Windows\SysWOW64\epfjk.cc3	install4821093.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 45 IoCs

pid	pid_target	Process	procid_target
4812	3104	WerFault.exe	93
2868	1444	WerFault.exe	101
3904	1724	WerFault.exe	104
1044	2336	WerFault.exe	106
752	2184	WerFault.exe	111
3128	4908	WerFault.exe	114
1832	3896	WerFault.exe	119
2388	4244	WerFault.exe	122
4944	1164	WerFault.exe	125
4044	3268	WerFault.exe	128
2608	3224	WerFault.exe	131
2880	2272	WerFault.exe	134
3492	1600	WerFault.exe	138
2864	4572	WerFault.exe	141
2144	1208	WerFault.exe	144
748	1956	WerFault.exe	147
1488	4008	WerFault.exe	151
3840	788	WerFault.exe	154
3164	3544	WerFault.exe	165
2336	5108	WerFault.exe	168
1940	748	WerFault.exe	171
2284	4008	WerFault.exe	174
3988	2656	WerFault.exe	177
3772	3444	WerFault.exe	180
4772	1984	WerFault.exe	183
2156	3976	WerFault.exe	186
4028	2272	WerFault.exe	189
3612	868	WerFault.exe	191
3584	4852	WerFault.exe	195
2144	3568	WerFault.exe	198
876	3904	WerFault.exe	201
3272	4064	WerFault.exe	205
3260	4644	WerFault.exe	208
3356	4360	WerFault.exe	211
3596	752	WerFault.exe	214
4864	2260	WerFault.exe	217
796	1136	WerFault.exe	220
4020	4920	WerFault.exe	223
3492	2272	WerFault.exe	227
2968	3384	WerFault.exe	230
1272	5096	WerFault.exe	233
828	4108	WerFault.exe	236
3632	2308	WerFault.exe	239
2420	3128	WerFault.exe	242
4588	4340	WerFault.exe	245

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	en.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install4821093.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install4903109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x00050000000229c7-5.dat	nsis_installer_2
behavioral2/files/0x000200000001e70f-19.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
3504	install4821093.exe
3504	install4821093.exe
4860	install4903109.exe
4860	install4903109.exe
2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeBackupPrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	4860	install4903109.exe
Token: SeRestorePrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeBackupPrivilege	3504	install4821093.exe
Token: SeRestorePrivilege	3504	install4821093.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4480	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	86
PID 2040 wrote to memory of 4480	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	86
PID 2040 wrote to memory of 4480	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	86
PID 4480 wrote to memory of 3504	4480	en.exe	88
PID 4480 wrote to memory of 3504	4480	en.exe	88
PID 4480 wrote to memory of 3504	4480	en.exe	88
PID 2040 wrote to memory of 2296	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	89
PID 2040 wrote to memory of 2296	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	89
PID 2040 wrote to memory of 2296	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	89
PID 2296 wrote to memory of 4860	2296	qa.exe	90
PID 2296 wrote to memory of 4860	2296	qa.exe	90
PID 2296 wrote to memory of 4860	2296	qa.exe	90
PID 2040 wrote to memory of 1072	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	95
PID 2040 wrote to memory of 1072	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	95
PID 2040 wrote to memory of 1072	2040	JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe	95

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_623ff1aabf9747161a364868ea2a6784.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\ProgramData\en.exe
  "C:\ProgramData\en.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Users\Admin\AppData\Roaming\install4821093.exe
    C:\Users\Admin\AppData\Roaming\install4821093.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- C:\ProgramData\qa.exe
  "C:\ProgramData\qa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Users\Admin\AppData\Roaming\install4903109.exe
    C:\Users\Admin\AppData\Roaming\install4903109.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 596
  2⤵
  - Program crash
  PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3104 -ip 3104
1⤵
PID:3820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 592
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1444 -ip 1444
1⤵
PID:1408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 592
  2⤵
  - Program crash
  PID:3904

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 592
  2⤵
  - Program crash
  PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1724 -ip 1724
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2336 -ip 2336
1⤵
PID:4728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 592
  2⤵
  - Program crash
  PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2184 -ip 2184
1⤵
PID:3428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 592
  2⤵
  - Program crash
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4908 -ip 4908
1⤵
PID:4008

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 592
  2⤵
  - Program crash
  PID:1832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3896 -ip 3896
1⤵
PID:1076

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 592
  2⤵
  - Program crash
  PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4244 -ip 4244
1⤵
PID:652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 592
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1164 -ip 1164
1⤵
PID:4456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 592
  2⤵
  - Program crash
  PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3268 -ip 3268
1⤵
PID:1612

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 592
  2⤵
  - Program crash
  PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3224 -ip 3224
1⤵
PID:4092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 592
  2⤵
  - Program crash
  PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2272 -ip 2272
1⤵
PID:4580

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 592
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1600 -ip 1600
1⤵
PID:4400

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 592
  2⤵
  - Program crash
  PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4572 -ip 4572
1⤵
PID:4268

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 592
  2⤵
  - Program crash
  PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1208 -ip 1208
1⤵
PID:2216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 592
  2⤵
  - Program crash
  PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1956 -ip 1956
1⤵
PID:2336

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 592
  2⤵
  - Program crash
  PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4008 -ip 4008
1⤵
PID:4996

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 592
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 788 -ip 788
1⤵
PID:1092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 592
  2⤵
  - Program crash
  PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3544 -ip 3544
1⤵
PID:2216

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 592
  2⤵
  - Program crash
  PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5108 -ip 5108
1⤵
PID:2228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 592
  2⤵
  - Program crash
  PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 748 -ip 748
1⤵
PID:2072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 580
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4008 -ip 4008
1⤵
PID:536

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 592
  2⤵
  - Program crash
  PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2656 -ip 2656
1⤵
PID:4488

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 592
  2⤵
  - Program crash
  PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3444 -ip 3444
1⤵
PID:400

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 592
  2⤵
  - Program crash
  PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1984 -ip 1984
1⤵
PID:3676

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 596
  2⤵
  - Program crash
  PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3976 -ip 3976
1⤵
PID:1136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 592
  2⤵
  - Program crash
  PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2272 -ip 2272
1⤵
PID:2880

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 592
  2⤵
  - Program crash
  PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 868 -ip 868
1⤵
PID:4092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 432
  2⤵
  - Program crash
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4852 -ip 4852
1⤵
PID:5012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 592
  2⤵
  - Program crash
  PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3568 -ip 3568
1⤵
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 592
  2⤵
  - Program crash
  PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3904 -ip 3904
1⤵
PID:916

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 592
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4064 -ip 4064
1⤵
PID:1092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 592
  2⤵
  - Program crash
  PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4644 -ip 4644
1⤵
PID:4556

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 592
  2⤵
  - Program crash
  PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4360 -ip 4360
1⤵
PID:3296

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 592
  2⤵
  - Program crash
  PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 752 -ip 752
1⤵
PID:1980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 436
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2260 -ip 2260
1⤵
PID:1964

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 592
  2⤵
  - Program crash
  PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1136 -ip 1136
1⤵
PID:4392

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 592
  2⤵
  - Program crash
  PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4920 -ip 4920
1⤵
PID:1636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 592
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2272 -ip 2272
1⤵
PID:4544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 540
  2⤵
  - Program crash
  PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3384 -ip 3384
1⤵
PID:4984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 540
  2⤵
  - Program crash
  PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5096 -ip 5096
1⤵
PID:4660

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k OutlookSharing
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 540
  2⤵
  - Program crash
  PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4108 -ip 4108
1⤵
PID:2052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 540
  2⤵
  - Program crash
  PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2308 -ip 2308
1⤵
PID:4856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 540
  2⤵
  - Program crash
  PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3128 -ip 3128
1⤵
PID:4412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k CurrentControlServices
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 540
  2⤵
  - Program crash
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4340 -ip 4340
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\en.exe

Filesize
118KB

MD5
2d32fa5e3cb6e967cf3e93d14756c443

SHA1
fc584e983cddc75bd953c6fb47107b503e7c3b13

SHA256
ab74ee4cef9b9d08b9f46cc276047ff490b83588a0ef301e7982aae59663e888

SHA512
c187efea4808cd33d942acac74ac43b35cd336c992e6f277698e1ab60510fd7debc2d2650ffc4952d5715f1d54e6c58130a7ed838afb15fa072d5348e1b32a00

Download Submit
C:\ProgramData\qa.exe

Filesize
117KB

MD5
6f09bbc6d1e24d76251c0a566ca4310b

SHA1
f38af11d64517fd6e5294e6017e25c016fe0bd7d

SHA256
63bd165b4037893b26af4bf6a29e0dfe6637f0649caddd7196872e5fca2af8c0

SHA512
8eb44d4c7c08cd668b30236193512d1e274922b7b8a1c200af69edba1a83def382c7e2d8b32885fbc658b2ed3c5173fde095f79d39f5209ce51a6168b4f97db0

Download Submit
C:\Users\Admin\AppData\Roaming\install4821093.exe

Filesize
192KB

MD5
2cdced1cdbb37e687771c7eb297eebc5

SHA1
94ba6b37a5e81090672ed0dc6f4c63dc6b0ee537

SHA256
e008441c0d970ec6a3ac09027b5a32050599339d87ee5392457ce692d2099580

SHA512
330d6ba34633214f5a24e0d18a702121fc87b779ab37f79676f91c09db3be1c158d4e5606dd0529dddc2a822e6d07791a83d72cfbb7e38f8a8b2f38c9ec69def

Download Submit
C:\Users\Admin\AppData\Roaming\install4903109.exe

Filesize
192KB

MD5
1d3bf95fb92486b71c1c8939ebc27f08

SHA1
008b3fdf0b742b306f50f8503dc5be4b1023a4ca

SHA256
c333f006f231c1dd310d8f97010120cdf710f43fcb555eeec27232f202c2fcf8

SHA512
8f262e10fa53e70f41acb02fcc3208871d9b9ca5e263f3a70aa14aa4b8cb9169e73963740aa3e600e8e4830c67e5c6513721e36decf740f843c8ae8e7b0388e5

Download Submit
C:\Windows\SysWOW64\epfjk.cc3

Filesize
23.0MB

MD5
11142d50a14c5f37b82ab2f431e5550d

SHA1
b555a300979f2269158fb40d935b1ba6466d13ef

SHA256
d370af135b9907a2c33c195aa00cc9ba701c3044d6f8c145fb66a003eca85df0

SHA512
45acd39548603cba1e656946b1d8ed456f4517e626b318201dc6f1411fc77983d74dd2ab0f589da89731701d8cb9e8909099ba619deb36cd2b4753b40384b28a

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
22.0MB

MD5
2ad6a029fc1efd2389bc99f068a9db36

SHA1
84d2848cefe50a32c8b119b3527f751591096c80

SHA256
aaa92eb7d6936723d9dd0b08e7a45452f788349efe8fb053e5f10eea55ab72fd

SHA512
a9a314dd48f8b34c489c73c7fbe9463d318ae56f21a3ca9e917d1bfab86166affa5eeb7f8730882fb11a422fab31e8b97001dbb6d9f40a2783c65268f12015b9

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
22.0MB

MD5
df96c2b6100f726bbbb0c76f8a2013db

SHA1
fbbafaf7c472b221b2e3a9dfa8edc5d47ed6bae8

SHA256
fb8b524c1e333471d6317bb14b242f719276a217a79a115f434e79e329916683

SHA512
78bbd2cb80feba61743d1d927840872b56fe3ad9c8739cf454f4626876c868d400cf7b6fcf69c2add745fae491b536686059b74dd943aeedced158bb3bd25663

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
21.1MB

MD5
5d8e8aa5a4b974164a29ac461609b506

SHA1
b4bc267964a9a93cd3c121996d73065ac00dff38

SHA256
ea3360c08bfd24cd7d4b9d0b58b0a306b870661975092ecb70bca5da999ceca1

SHA512
63c4325c5ba2ae918df3f26199d4abf461cccfc7681aee50d2b34a278e35f55ba166d7c865baba2eb41eee3fab6d7a675a32842460c240901bd31d3970ef598b

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
24.1MB

MD5
f14bbfa28de80586aa572bc61e84f740

SHA1
a8f3e407d8d48d8617eb58ac12b8b31f6d4e8748

SHA256
08215da50a627be39cec342aac1f1ed1317d48105ac8de603c8c51c25646b4d6

SHA512
bf98b007f1dc169ecad03a74dfa448975c72284d1651606ea0ab33dcc4731ecd1335f6315c2b88413da08837af49e0675a4a258f387427dc113bc844c50d8a61

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
20.0MB

MD5
5c542fcb8dab24559abb94ba5f77daea

SHA1
aa6c15cbffd9f02efd5fa62fbcf39802d1620360

SHA256
a3296ff181ca56ba773b34e7eb94e4493ddd235355faf43532985fe473f6a6ef

SHA512
b0a07add515142fc3b62128e2bc292a2462a598a7a4438a9a0e5158c21ff76b3f2a3b65bcecb9754f16be88bf75c5b551aaae4267d34d22c3ee5ea2f3f98e49a

Download Submit
\??\c:\windows\SysWOW64\epfjk.cc3

Filesize
23.0MB

MD5
b8fe6cb716ffa489d2f52fc46d17c315

SHA1
bff022043ccd06efa5f74ecedaaba93b9866d778

SHA256
ba3514537604cba36b803dc60e46d070848a3b7469f218d7cf0d499ee8b1fbcf

SHA512
4dbf1ff5b0a670d391326486e0b91457ebca23a801d87f23cb3eb72bdd4c292cc26298eef38af560e007005e3803c9ce355e8b0dc6a51ff5789bfc8a35b453f4

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
24.1MB

MD5
0e3c476557636d5ccb5aa1ffd190259b

SHA1
81d741d8a75a9f07d23d8833f3515ad711aea53d

SHA256
da184634f1fba7a48cab8b261a38308f28e4ce32ecd39e778f9f08e2f52b61ff

SHA512
a8035e7833b87a71ad91436f80c228bed10f4f7082cf1cab4a9178ac12fe80b0628728281e7f45e333e277a522815ab706f5197289a3c4caf8d2273f3ee7658e

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
20.1MB

MD5
37d7c150fd7e00dd83a9b5ab29dd7c75

SHA1
d4d819c5cb451a4a7aade6022a9c0fb1ab2f33ad

SHA256
e19778c2e568a834611aec7e26554b595b3a651a05f67cc06b683ee50e150d2a

SHA512
1b8662324706f55ef35122d2f4354f3965b6e8ce864259bafaea813113d03943905c6afef5563bae960b03f2b0d3f10a6594214c0e8020aa747c466798aa39a7

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
22.0MB

MD5
0c9e0acd4b544f6b51fe87b1ce24e283

SHA1
aa7479135a77ee4393601b92afef54bda459b8ef

SHA256
aa25d73a46eb9ea34f1d1e2ef9c098fcb923e3c4e89638051a18c1750bdb3356

SHA512
74cab71e55abd4c2baa2d5c6fb2860d8a67b0c4ad0c758f71a102a40799e4e53280bb4dc9fc7d1ea1c25127f9014ae162cded7484f296d2c6ddf3b6f8a6e2f14

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
23.1MB

MD5
1e5d897bd27e8d6f5d7759be80cc2146

SHA1
c32dbc15146c052608dd37bef8c7372b8df0ebe2

SHA256
cf51ee401152dba3d89b8f7f5689c56da87e5789307e31a9de88a5bbe83750ec

SHA512
af4604a533a6f86e87a1c4c2ad22ae7c29d2699d195410ffa2a29ea81e8315e274f2ff402426d018481f22157a1b2177a2edddbdf6ab54b1dfbc7a897170f662

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
19.1MB

MD5
8330a95986b32d6a3d45ef4e90fbbf56

SHA1
74c574f186f2ba872407b24edff2bd2855333b38

SHA256
39dcc670684e48b442f0c0db5b906b52e7fcaa4e732170cf50c2f5e722aaa627

SHA512
0afb7cbac82fb1ca0b4ec003c2846d65e1d6b7652617dfe1e3ed03a1ffbae025c83e493a8a88e6cb527f86d2ecd47313f194234faaa0e6388dc3b6e0d16f2ce2

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
22.0MB

MD5
94be1b52fa008c2a7ea295e0c4cc0e9f

SHA1
88e7185a2dc35724ee91fe389bd3cf4e08116c44

SHA256
caf950b80177e017403f65c3ced995bc1a2410d25a7cc58a3abed881acf2f57e

SHA512
67cbaaf46c024395a14d2c0d28e7e2b1ce4ba9e184d6bb307e3400850d9a1eed60a3d8a6a5e23c836397df4d61669b9380aad60ba7de4b6c7f27984501874598

Download Submit
\??\c:\windows\SysWOW64\lqlub.cc3

Filesize
20.1MB

MD5
035a72181978edecb3a0d83efda828ae

SHA1
e437cd95a2133d3646623ae58b13fc14d8ae72a8

SHA256
20e8d0af5e4ff6ff86bce8f3c2c9b558ac1ebf37bfc1c806b655ff1a88c4e311

SHA512
adb442787b2ee1d548ef2c813e0d8da82a2f00ca06ac8db914761ba76aea43198fc296d683c6286cf0d7519da6cf4d7ef5215338346221593ee106ca9eb233cd

Download Submit
memory/2040-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2040-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download