Overview

overview

7

Static

static

3

eb13dc9ff4...e7.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    51s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/08/2026, 15:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
  • Size 1021KB
  • Sample260827-svjcsswtgt
  • SHA256 eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 45 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 45 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 45 IoCs
    defense_evasiontrojan
  • Program crash 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    "C:\Users\Admin\AppData\Local\Temp\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe"
    1⤵
    • Creates a file in the Startup directory
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 3052
      2⤵
      • Program crash
      PID:9964
  • C:\PROGRA~3\{F31F5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{F31F5~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 2964
      2⤵
      • Program crash
      PID:5084
  • C:\PROGRA~3\{C6201~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{C6201~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2940
      2⤵
      • Program crash
      PID:4116
  • C:\PROGRA~3\{C681C~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{C681C~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 2948
      2⤵
      • Program crash
      PID:1772
  • C:\PROGRA~3\{054E1~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{054E1~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 2944
      2⤵
      • Program crash
      PID:3600
  • C:\PROGRA~3\{E5193~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{E5193~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3148
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 3000
      2⤵
      • Program crash
      PID:1168
  • C:\PROGRA~3\{C0C88~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{C0C88~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 2968
      2⤵
      • Program crash
      PID:3520
  • C:\PROGRA~3\{12E33~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
    C:\PROGRA~3\{12E33~1\EB13DC~1.EXE
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 2940
      2⤵
      • Program crash
      PID:2068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3556 -ip 3556
    1⤵
      PID:3208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2624 -ip 2624
      1⤵
        PID:3004
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3808 -ip 3808
        1⤵
          PID:3440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2644 -ip 2644
          1⤵
            PID:4744
          • C:\PROGRA~3\{E9A8C~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
            C:\PROGRA~3\{E9A8C~1\EB13DC~1.EXE
            1⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:4708
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 2892
              2⤵
              • Program crash
              PID:5644
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 828 -ip 828
            1⤵
              PID:3440
            • C:\PROGRA~3\{2CEFC~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
              C:\PROGRA~3\{2CEFC~1\EB13DC~1.EXE
              1⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:5192
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 2932
                2⤵
                • Program crash
                PID:5792
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4708 -ip 4708
              1⤵
                PID:5628
              • C:\PROGRA~3\{FA435~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                C:\PROGRA~3\{FA435~1\EB13DC~1.EXE
                1⤵
                • Creates a file in the Startup directory
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:5660
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 2956
                  2⤵
                  • Program crash
                  PID:5412
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5192 -ip 5192
                1⤵
                  PID:5764
                • C:\PROGRA~3\{B1813~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                  C:\PROGRA~3\{B1813~1\EB13DC~1.EXE
                  1⤵
                  • Creates a file in the Startup directory
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5956
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 2968
                    2⤵
                    • Program crash
                    PID:5964
                • C:\PROGRA~3\{F4535~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                  C:\PROGRA~3\{F4535~1\EB13DC~1.EXE
                  1⤵
                  • Creates a file in the Startup directory
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5224
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 2912
                    2⤵
                    • Program crash
                    PID:5396
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5660 -ip 5660
                  1⤵
                    PID:5544
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5956 -ip 5956
                    1⤵
                      PID:5976
                    • C:\PROGRA~3\{A8036~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                      C:\PROGRA~3\{A8036~1\EB13DC~1.EXE
                      1⤵
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:6012
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 6012 -s 2940
                        2⤵
                        • Program crash
                        PID:2212
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5224 -ip 5224
                      1⤵
                        PID:5312
                      • C:\PROGRA~3\{554A6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                        C:\PROGRA~3\{554A6~1\EB13DC~1.EXE
                        1⤵
                        • Creates a file in the Startup directory
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:6020
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 2948
                          2⤵
                          • Program crash
                          PID:6512
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6012 -ip 6012
                        1⤵
                          PID:5608
                        • C:\PROGRA~3\{6942F~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                          C:\PROGRA~3\{6942F~1\EB13DC~1.EXE
                          1⤵
                          • Creates a file in the Startup directory
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:6220
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 2888
                            2⤵
                            • Program crash
                            PID:6856
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6020 -ip 6020
                          1⤵
                            PID:6444
                          • C:\PROGRA~3\{F4291~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                            C:\PROGRA~3\{F4291~1\EB13DC~1.EXE
                            1⤵
                            • Creates a file in the Startup directory
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:6660
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 2928
                              2⤵
                              • Program crash
                              PID:6948
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6220 -ip 6220
                            1⤵
                              PID:6824
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6660 -ip 6660
                              1⤵
                                PID:6932
                              • C:\PROGRA~3\{D40EA~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                C:\PROGRA~3\{D40EA~1\EB13DC~1.EXE
                                1⤵
                                • Creates a file in the Startup directory
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:7032
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 2904
                                  2⤵
                                  • Program crash
                                  PID:6672
                              • C:\PROGRA~3\{96807~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                C:\PROGRA~3\{96807~1\EB13DC~1.EXE
                                1⤵
                                • Creates a file in the Startup directory
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of SetWindowsHookEx
                                PID:6464
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 2924
                                  2⤵
                                  • Program crash
                                  PID:7096
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7032 -ip 7032
                                1⤵
                                  PID:6700
                                • C:\PROGRA~3\{4D25D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                  C:\PROGRA~3\{4D25D~1\EB13DC~1.EXE
                                  1⤵
                                  • Creates a file in the Startup directory
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of SetWindowsHookEx
                                  PID:6996
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 2944
                                    2⤵
                                    • Program crash
                                    PID:7116
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6464 -ip 6464
                                  1⤵
                                    PID:7068
                                  • C:\PROGRA~3\{F268F~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                    C:\PROGRA~3\{F268F~1\EB13DC~1.EXE
                                    1⤵
                                    • Creates a file in the Startup directory
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6672
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 2952
                                      2⤵
                                      • Program crash
                                      PID:4388
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6996 -ip 6996
                                    1⤵
                                      PID:7064
                                    • C:\PROGRA~3\{061C9~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                      C:\PROGRA~3\{061C9~1\EB13DC~1.EXE
                                      1⤵
                                      • Creates a file in the Startup directory
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      • Suspicious use of SetWindowsHookEx
                                      PID:7108
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 2964
                                        2⤵
                                        • Program crash
                                        PID:7288
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6672 -ip 6672
                                      1⤵
                                        PID:6780
                                      • C:\PROGRA~3\{7DCDD~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                        C:\PROGRA~3\{7DCDD~1\EB13DC~1.EXE
                                        1⤵
                                        • Creates a file in the Startup directory
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:7188
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 1316
                                          2⤵
                                          • Program crash
                                          PID:7548
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7108 -ip 7108
                                        1⤵
                                          PID:7252
                                        • C:\PROGRA~3\{0360D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                          C:\PROGRA~3\{0360D~1\EB13DC~1.EXE
                                          1⤵
                                          • Creates a file in the Startup directory
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          PID:7456
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7456 -s 2872
                                            2⤵
                                            • Program crash
                                            PID:7852
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 7188 -ip 7188
                                          1⤵
                                            PID:7512
                                          • C:\PROGRA~3\{B34C5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                            C:\PROGRA~3\{B34C5~1\EB13DC~1.EXE
                                            1⤵
                                            • Creates a file in the Startup directory
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:7760
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7760 -s 2936
                                              2⤵
                                              • Program crash
                                              PID:8132
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7456 -ip 7456
                                            1⤵
                                              PID:7824
                                            • C:\PROGRA~3\{EF3D2~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                              C:\PROGRA~3\{EF3D2~1\EB13DC~1.EXE
                                              1⤵
                                              • Creates a file in the Startup directory
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of SetWindowsHookEx
                                              PID:8024
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 8024 -s 2900
                                                2⤵
                                                • Program crash
                                                PID:6072
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7760 -ip 7760
                                              1⤵
                                                PID:8104
                                              • C:\PROGRA~3\{63702~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                C:\PROGRA~3\{63702~1\EB13DC~1.EXE
                                                1⤵
                                                • Creates a file in the Startup directory
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4664
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 3024
                                                  2⤵
                                                  • Program crash
                                                  PID:12252
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 8024 -ip 8024
                                                1⤵
                                                  PID:7576
                                                • C:\PROGRA~3\{54D8E~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                  C:\PROGRA~3\{54D8E~1\EB13DC~1.EXE
                                                  1⤵
                                                  • Creates a file in the Startup directory
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:7736
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 2924
                                                    2⤵
                                                    • Program crash
                                                    PID:7584
                                                • C:\PROGRA~3\{8A2E6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                  C:\PROGRA~3\{8A2E6~1\EB13DC~1.EXE
                                                  1⤵
                                                  • Creates a file in the Startup directory
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:7276
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 7276 -s 2868
                                                    2⤵
                                                    • Program crash
                                                    PID:7308
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7736 -ip 7736
                                                  1⤵
                                                    PID:7496
                                                  • C:\PROGRA~3\{78DEB~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                    C:\PROGRA~3\{78DEB~1\EB13DC~1.EXE
                                                    1⤵
                                                    • Creates a file in the Startup directory
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:7940
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7940 -s 2932
                                                      2⤵
                                                      • Program crash
                                                      PID:8216
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7276 -ip 7276
                                                    1⤵
                                                      PID:7788
                                                    • C:\PROGRA~3\{9DF6F~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                      C:\PROGRA~3\{9DF6F~1\EB13DC~1.EXE
                                                      1⤵
                                                      • Creates a file in the Startup directory
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:7600
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 2896
                                                        2⤵
                                                        • Program crash
                                                        PID:8512
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7940 -ip 7940
                                                      1⤵
                                                        PID:2488
                                                      • C:\PROGRA~3\{16F6E~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                        C:\PROGRA~3\{16F6E~1\EB13DC~1.EXE
                                                        1⤵
                                                        • Creates a file in the Startup directory
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:8372
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 8372 -s 2924
                                                          2⤵
                                                          • Program crash
                                                          PID:8780
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 7600 -ip 7600
                                                        1⤵
                                                          PID:8500
                                                        • C:\PROGRA~3\{5D86C~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                          C:\PROGRA~3\{5D86C~1\EB13DC~1.EXE
                                                          1⤵
                                                          • Creates a file in the Startup directory
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:8672
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 8672 -s 2868
                                                            2⤵
                                                            • Program crash
                                                            PID:9048
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8372 -ip 8372
                                                          1⤵
                                                            PID:8752
                                                          • C:\PROGRA~3\{FA627~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                            C:\PROGRA~3\{FA627~1\EB13DC~1.EXE
                                                            1⤵
                                                            • Creates a file in the Startup directory
                                                            • Executes dropped EXE
                                                            • Checks whether UAC is enabled
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:8936
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 8936 -s 2976
                                                              2⤵
                                                              • Program crash
                                                              PID:8352
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 8672 -ip 8672
                                                            1⤵
                                                              PID:9032
                                                            • C:\PROGRA~3\{F1F4A~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                              C:\PROGRA~3\{F1F4A~1\EB13DC~1.EXE
                                                              1⤵
                                                              • Creates a file in the Startup directory
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:9212
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 9212 -s 2880
                                                                2⤵
                                                                • Program crash
                                                                PID:8768
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8936 -ip 8936
                                                              1⤵
                                                                PID:8328
                                                              • C:\PROGRA~3\{E2B85~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                C:\PROGRA~3\{E2B85~1\EB13DC~1.EXE
                                                                1⤵
                                                                • Creates a file in the Startup directory
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:8552
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 8552 -s 2864
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:8232
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 9212 -ip 9212
                                                                1⤵
                                                                  PID:8740
                                                                • C:\PROGRA~3\{2596D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                  C:\PROGRA~3\{2596D~1\EB13DC~1.EXE
                                                                  1⤵
                                                                  • Creates a file in the Startup directory
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:9052
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 9052 -s 2868
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:3140
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 8552 -ip 8552
                                                                  1⤵
                                                                    PID:8220
                                                                  • C:\PROGRA~3\{5F814~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                    C:\PROGRA~3\{5F814~1\EB13DC~1.EXE
                                                                    1⤵
                                                                    • Creates a file in the Startup directory
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:8756
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 8756 -s 2848
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:8976
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9052 -ip 9052
                                                                    1⤵
                                                                      PID:9140
                                                                    • C:\PROGRA~3\{FB9E5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                      C:\PROGRA~3\{FB9E5~1\EB13DC~1.EXE
                                                                      1⤵
                                                                      • Creates a file in the Startup directory
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:5176
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 2944
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:9400
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 8756 -ip 8756
                                                                      1⤵
                                                                        PID:7788
                                                                      • C:\PROGRA~3\{26E1C~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                        C:\PROGRA~3\{26E1C~1\EB13DC~1.EXE
                                                                        1⤵
                                                                        • Creates a file in the Startup directory
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:9292
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 9292 -s 2932
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:9532
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5176 -ip 5176
                                                                        1⤵
                                                                          PID:9384
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 9292 -ip 9292
                                                                          1⤵
                                                                            PID:9512
                                                                          • C:\PROGRA~3\{FF3F5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                            C:\PROGRA~3\{FF3F5~1\EB13DC~1.EXE
                                                                            1⤵
                                                                            • Creates a file in the Startup directory
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:9620
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 9620 -s 2904
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:9952
                                                                          • C:\PROGRA~3\{8EC65~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                            C:\PROGRA~3\{8EC65~1\EB13DC~1.EXE
                                                                            1⤵
                                                                            • Creates a file in the Startup directory
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:9848
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 9848 -s 2860
                                                                              2⤵
                                                                              • Program crash
                                                                              PID:10220
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 9620 -ip 9620
                                                                            1⤵
                                                                              PID:9916
                                                                            • C:\PROGRA~3\{61A4B~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                              C:\PROGRA~3\{61A4B~1\EB13DC~1.EXE
                                                                              1⤵
                                                                              • Creates a file in the Startup directory
                                                                              • Executes dropped EXE
                                                                              • Checks whether UAC is enabled
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:10112
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 10112 -s 2884
                                                                                2⤵
                                                                                • Program crash
                                                                                PID:2972
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9848 -ip 9848
                                                                              1⤵
                                                                                PID:10204
                                                                              • C:\PROGRA~3\{9FBD6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                C:\PROGRA~3\{9FBD6~1\EB13DC~1.EXE
                                                                                1⤵
                                                                                • Creates a file in the Startup directory
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                • Suspicious use of SendNotifyMessage
                                                                                PID:9412
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 9412 -s 2856
                                                                                  2⤵
                                                                                  • Program crash
                                                                                  PID:9980
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10112 -ip 10112
                                                                                1⤵
                                                                                  PID:4656
                                                                                • C:\PROGRA~3\{D2A4A~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                  C:\PROGRA~3\{D2A4A~1\EB13DC~1.EXE
                                                                                  1⤵
                                                                                  • Creates a file in the Startup directory
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  PID:9684
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 9684 -s 2968
                                                                                    2⤵
                                                                                    • Program crash
                                                                                    PID:10144
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4040 -ip 4040
                                                                                  1⤵
                                                                                    PID:1696
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3148 -ip 3148
                                                                                    1⤵
                                                                                      PID:9784
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3460 -ip 3460
                                                                                      1⤵
                                                                                        PID:9892
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9412 -ip 9412
                                                                                        1⤵
                                                                                          PID:9920
                                                                                        • C:\PROGRA~3\{320E6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                          C:\PROGRA~3\{320E6~1\EB13DC~1.EXE
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:10184
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 10184 -s 2992
                                                                                            2⤵
                                                                                            • Program crash
                                                                                            PID:3756
                                                                                        • C:\PROGRA~3\{C4E60~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                          C:\PROGRA~3\{C4E60~1\EB13DC~1.EXE
                                                                                          1⤵
                                                                                            PID:9716
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 9716 -s 2968
                                                                                              2⤵
                                                                                              • Program crash
                                                                                              PID:10568
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 9684 -ip 9684
                                                                                            1⤵
                                                                                              PID:10052
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10184 -ip 10184
                                                                                              1⤵
                                                                                                PID:10204
                                                                                              • C:\PROGRA~3\{DCC09~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                C:\PROGRA~3\{DCC09~1\EB13DC~1.EXE
                                                                                                1⤵
                                                                                                  PID:832
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 2940
                                                                                                    2⤵
                                                                                                    • Program crash
                                                                                                    PID:10668
                                                                                                • C:\PROGRA~3\{892B3~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                  C:\PROGRA~3\{892B3~1\EB13DC~1.EXE
                                                                                                  1⤵
                                                                                                    PID:10252
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 10252 -s 2944
                                                                                                      2⤵
                                                                                                      • Program crash
                                                                                                      PID:10708
                                                                                                  • C:\PROGRA~3\{83EDF~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                    C:\PROGRA~3\{83EDF~1\EB13DC~1.EXE
                                                                                                    1⤵
                                                                                                      PID:10512
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 10512 -s 2884
                                                                                                        2⤵
                                                                                                        • Program crash
                                                                                                        PID:10968
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 9716 -ip 9716
                                                                                                      1⤵
                                                                                                        PID:10556
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 832 -ip 832
                                                                                                        1⤵
                                                                                                          PID:10644
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 10252 -ip 10252
                                                                                                          1⤵
                                                                                                            PID:10688
                                                                                                          • C:\PROGRA~3\{32E23~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                            C:\PROGRA~3\{32E23~1\EB13DC~1.EXE
                                                                                                            1⤵
                                                                                                              PID:10888
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 10888 -s 2972
                                                                                                                2⤵
                                                                                                                • Program crash
                                                                                                                PID:3168
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 10512 -ip 10512
                                                                                                              1⤵
                                                                                                                PID:10944
                                                                                                              • C:\PROGRA~3\{7994D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                C:\PROGRA~3\{7994D~1\EB13DC~1.EXE
                                                                                                                1⤵
                                                                                                                  PID:11156
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 11156 -s 2908
                                                                                                                    2⤵
                                                                                                                    • Program crash
                                                                                                                    PID:10712
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 10888 -ip 10888
                                                                                                                  1⤵
                                                                                                                    PID:10244
                                                                                                                  • C:\PROGRA~3\{18A7F~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                    C:\PROGRA~3\{18A7F~1\EB13DC~1.EXE
                                                                                                                    1⤵
                                                                                                                      PID:10564
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 10564 -s 2884
                                                                                                                        2⤵
                                                                                                                        • Program crash
                                                                                                                        PID:11144
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11156 -ip 11156
                                                                                                                      1⤵
                                                                                                                        PID:10704
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 10564 -ip 10564
                                                                                                                        1⤵
                                                                                                                          PID:11124
                                                                                                                        • C:\PROGRA~3\{75BE7~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                          C:\PROGRA~3\{75BE7~1\EB13DC~1.EXE
                                                                                                                          1⤵
                                                                                                                            PID:11148
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 11148 -s 2992
                                                                                                                              2⤵
                                                                                                                              • Program crash
                                                                                                                              PID:10508
                                                                                                                          • C:\PROGRA~3\{12C0F~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                            C:\PROGRA~3\{12C0F~1\EB13DC~1.EXE
                                                                                                                            1⤵
                                                                                                                              PID:6360
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 2436
                                                                                                                                2⤵
                                                                                                                                • Program crash
                                                                                                                                PID:2496
                                                                                                                            • C:\PROGRA~3\{D7D3D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                              C:\PROGRA~3\{D7D3D~1\EB13DC~1.EXE
                                                                                                                              1⤵
                                                                                                                                PID:9932
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 9932 -s 2844
                                                                                                                                  2⤵
                                                                                                                                  • Program crash
                                                                                                                                  PID:11488
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 11148 -ip 11148
                                                                                                                                1⤵
                                                                                                                                  PID:2856
                                                                                                                                • C:\PROGRA~3\{C9B0B~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                  C:\PROGRA~3\{C9B0B~1\EB13DC~1.EXE
                                                                                                                                  1⤵
                                                                                                                                    PID:4080
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 2864
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:11504
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6360 -ip 6360
                                                                                                                                    1⤵
                                                                                                                                      PID:10700
                                                                                                                                    • C:\PROGRA~3\{915F9~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                      C:\PROGRA~3\{915F9~1\EB13DC~1.EXE
                                                                                                                                      1⤵
                                                                                                                                        PID:11344
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 11344 -s 2892
                                                                                                                                          2⤵
                                                                                                                                          • Program crash
                                                                                                                                          PID:11860
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 9932 -ip 9932
                                                                                                                                        1⤵
                                                                                                                                          PID:11432
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4080 -ip 4080
                                                                                                                                          1⤵
                                                                                                                                            PID:11464
                                                                                                                                          • C:\PROGRA~3\{3A0BE~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                            C:\PROGRA~3\{3A0BE~1\EB13DC~1.EXE
                                                                                                                                            1⤵
                                                                                                                                              PID:11684
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 11684 -s 2876
                                                                                                                                                2⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:11388
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 11344 -ip 11344
                                                                                                                                              1⤵
                                                                                                                                                PID:11844
                                                                                                                                              • C:\PROGRA~3\{67C84~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                C:\PROGRA~3\{67C84~1\EB13DC~1.EXE
                                                                                                                                                1⤵
                                                                                                                                                  PID:11876
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 11876 -s 2944
                                                                                                                                                    2⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:11476
                                                                                                                                                • C:\PROGRA~3\{5C8E7~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                  C:\PROGRA~3\{5C8E7~1\EB13DC~1.EXE
                                                                                                                                                  1⤵
                                                                                                                                                    PID:12216
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 12216 -s 2896
                                                                                                                                                      2⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:11864
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 11684 -ip 11684
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2612
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 11876 -ip 11876
                                                                                                                                                      1⤵
                                                                                                                                                        PID:11440
                                                                                                                                                      • C:\PROGRA~3\{5BA19~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                        C:\PROGRA~3\{5BA19~1\EB13DC~1.EXE
                                                                                                                                                        1⤵
                                                                                                                                                          PID:11772
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 11772 -s 2956
                                                                                                                                                            2⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:11560
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 12216 -ip 12216
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1432
                                                                                                                                                          • C:\PROGRA~3\{8F06D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                            C:\PROGRA~3\{8F06D~1\EB13DC~1.EXE
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3432
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 3028
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:14728
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4664 -ip 4664
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:12236
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 11772 -ip 11772
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:11460
                                                                                                                                                                  • C:\PROGRA~3\{6A6B5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                    C:\PROGRA~3\{6A6B5~1\EB13DC~1.EXE
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5620
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 2876
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        PID:5968
                                                                                                                                                                    • C:\PROGRA~3\{07CCB~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                      C:\PROGRA~3\{07CCB~1\EB13DC~1.EXE
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:9068
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 9068 -s 2900
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Program crash
                                                                                                                                                                          PID:11828
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5620 -ip 5620
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4728
                                                                                                                                                                        • C:\PROGRA~3\{5CA70~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                          C:\PROGRA~3\{5CA70~1\EB13DC~1.EXE
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:1272
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 2896
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:12320
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9068 -ip 9068
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:6184
                                                                                                                                                                              • C:\PROGRA~3\{C8DF0~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                C:\PROGRA~3\{C8DF0~1\EB13DC~1.EXE
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6576
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 2852
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:12700
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1272 -ip 1272
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:6688
                                                                                                                                                                                    • C:\PROGRA~3\{1F6F4~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                      C:\PROGRA~3\{1F6F4~1\EB13DC~1.EXE
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:12548
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 12548 -s 2992
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:12924
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6576 -ip 6576
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:12660
                                                                                                                                                                                          • C:\PROGRA~3\{F88CF~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                            C:\PROGRA~3\{F88CF~1\EB13DC~1.EXE
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:12820
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 12820 -s 2900
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:13180
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12548 -ip 12548
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:12892
                                                                                                                                                                                                • C:\PROGRA~3\{4201D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                  C:\PROGRA~3\{4201D~1\EB13DC~1.EXE
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:13100
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 13100 -s 2956
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:7044
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12820 -ip 12820
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:13156
                                                                                                                                                                                                      • C:\PROGRA~3\{A529E~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                        C:\PROGRA~3\{A529E~1\EB13DC~1.EXE
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:12384
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 12384 -s 2900
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:12928
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 13100 -ip 13100
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:7028
                                                                                                                                                                                                            • C:\PROGRA~3\{4D200~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                              C:\PROGRA~3\{4D200~1\EB13DC~1.EXE
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:12812
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 12812 -s 2900
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:12428
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12384 -ip 12384
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:12908
                                                                                                                                                                                                                  • C:\PROGRA~3\{4E60C~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                    C:\PROGRA~3\{4E60C~1\EB13DC~1.EXE
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:6928
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6928 -s 2940
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:13216
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12812 -ip 12812
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6732
                                                                                                                                                                                                                        • C:\PROGRA~3\{C560D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                          C:\PROGRA~3\{C560D~1\EB13DC~1.EXE
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:12968
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 12968 -s 2972
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:11544
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6928 -ip 6928
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:13000
                                                                                                                                                                                                                              • C:\PROGRA~3\{60BC6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                C:\PROGRA~3\{60BC6~1\EB13DC~1.EXE
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3764
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 2828
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1204
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 12968 -ip 12968
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:10948
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3764 -ip 3764
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:7728
                                                                                                                                                                                                                                      • C:\PROGRA~3\{AB17B~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                        C:\PROGRA~3\{AB17B~1\EB13DC~1.EXE
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:10532
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 10532 -s 2848
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                                                          • C:\PROGRA~3\{1B566~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                            C:\PROGRA~3\{1B566~1\EB13DC~1.EXE
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:9920
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 9920 -s 3028
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:15736
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 10532 -ip 10532
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:10988
                                                                                                                                                                                                                                                • C:\PROGRA~3\{3AD16~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                  C:\PROGRA~3\{3AD16~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:12336
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 12336 -s 2940
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:13520
                                                                                                                                                                                                                                                    • C:\PROGRA~3\{77A32~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                      C:\PROGRA~3\{77A32~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:13412
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 13412 -s 2972
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:13744
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 12336 -ip 12336
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:13492
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 13412 -ip 13412
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:13716
                                                                                                                                                                                                                                                            • C:\PROGRA~3\{3E6C5~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                              C:\PROGRA~3\{3E6C5~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:13724
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 13724 -s 2932
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:14100
                                                                                                                                                                                                                                                                • C:\PROGRA~3\{2A0D6~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                  C:\PROGRA~3\{2A0D6~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:14000
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 14000 -s 2864
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:14288
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 13724 -ip 13724
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:14080
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 14000 -ip 14000
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:14244
                                                                                                                                                                                                                                                                        • C:\PROGRA~3\{A64A1~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                          C:\PROGRA~3\{A64A1~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:14320
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 14320 -s 2948
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:13788
                                                                                                                                                                                                                                                                            • C:\PROGRA~3\{3E0E4~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                              C:\PROGRA~3\{3E0E4~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:13608
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 13608 -s 2908
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:9064
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 14320 -ip 14320
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:13744
                                                                                                                                                                                                                                                                                  • C:\PROGRA~3\{A87E4~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                    C:\PROGRA~3\{A87E4~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:14040
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 14040 -s 2844
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:8656
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 13608 -ip 13608
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:14212
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 14040 -ip 14040
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:8380
                                                                                                                                                                                                                                                                                          • C:\PROGRA~3\{44F9E~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                            C:\PROGRA~3\{44F9E~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 2952
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:9304
                                                                                                                                                                                                                                                                                              • C:\PROGRA~3\{32A86~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                C:\PROGRA~3\{32A86~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:14072
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 14072 -s 2904
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:13828
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5568 -ip 5568
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:14216
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 14072 -ip 14072
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:9596
                                                                                                                                                                                                                                                                                                      • C:\PROGRA~3\{09E7D~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                        C:\PROGRA~3\{09E7D~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:14084
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 14084 -s 2960
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:6380
                                                                                                                                                                                                                                                                                                          • C:\PROGRA~3\{F8A84~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                            C:\PROGRA~3\{F8A84~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:14120
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 14120 -s 2876
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:10128
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 14084 -ip 14084
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:9304
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 14120 -ip 14120
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:9856
                                                                                                                                                                                                                                                                                                                  • C:\PROGRA~3\{CB2E3~1\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                                    C:\PROGRA~3\{CB2E3~1\EB13DC~1.EXE
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:9692
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe" res://C:%5CPROGRA~3%5C%7BCB2E3~1%5Ceb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe/S0
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:14392
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:14392 CREDAT:17410 /prefetch:2
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:14508
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:14392 CREDAT:82946 /prefetch:2
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:14748
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 14748 -s 2084
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:14876
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3432 -ip 3432
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:14720
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 14748 -ip 14748
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:14860
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                  "dwm.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:14980
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9920 -ip 9920
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:15720

                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.dat
                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\{e5193cf6-c160-fb71-e519-93cf6c16f3db}\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.dat
                                                                                                                                                                                                                                                                                                                                          • Size 890B
                                                                                                                                                                                                                                                                                                                                          • SHA256 8af5146cb8f1a761676146bddd38159b2bb0c01b7168e404f553f02948686bc1
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                                                          • Path C:\ProgramData\{f31f598e-c0af-c768-f31f-f598ec0a663b}\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.exe
                                                                                                                                                                                                                                                                                                                                          • Size 1021KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          background_gradient[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\background_gradient[1]
                                                                                                                                                                                                                                                                                                                                          • Size 453B
                                                                                                                                                                                                                                                                                                                                          • SHA256 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          httpErrorPagesScripts[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D6NN03DP\httpErrorPagesScripts[1]
                                                                                                                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          bullet[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GF2Q29DT\bullet[1]
                                                                                                                                                                                                                                                                                                                                          • Size 447B
                                                                                                                                                                                                                                                                                                                                          • SHA256 1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          errorPageStrings[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GF2Q29DT\errorPageStrings[1]
                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          navcancl[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YK6WTHFY\navcancl[1]
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          ErrorPageTemplate[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQID18K\ErrorPageTemplate[1]
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          info_48[1]
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQID18K\info_48[1]
                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          loader.gif
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\BB00\images\loader.gif
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 fd257d1f5054621457d257514049b7e936ecd44075d0bde24227ff98d0d78d6f
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          progressbar.gif
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\BB00\images\progressbar.gif
                                                                                                                                                                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 d2aaec9f7679d519f2014443d2c5baba295a52473e7dcd0d85fd32c6247b0ddf
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 866daed04d0bc58e9440eed599c68fb31aa5a573c3d9745e92eead0a2707a579
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 445ab136e0a2c88b80d5186db8e10625bc7e7f7a2f919401e457969c2df9cd07
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 2b67aac78729e5477b869f51709d166a57a297a269085d5c62ef271d97e5adab
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 590597e9a82604d31002a866d126b82616321a5bcff86179ea0fcd3b244ca460
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b9c9949e080e7b4cc9b21a6c013b4907bedfe11139c903e0da886ca97e65c989
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 454ecd218420df1df1c6468eb4c69e35178e23b9085f570170b4eaf4ad1b723c
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 61871d93655b989ee0160ee86427a57b68e58685b4837757e0d1d4e630e9af54
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 d7ed90a4458d73859f46d8c6ece07194cb94e077a694da3750d082503c6011d8
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 2dd042356302d5d92d2494de01e532a96e6e4635049b4fa13685443866e8e1b4
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 60d2eaf710f6e9093eda67935c20ae4ef4a2d765e274ce353d7b1fed7a0724d8
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 e9378c793ddb3196f67a905338c5c642ff3c51fa5e133562c16b81e7fb16df9d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 4493c53840bf99aec0bb8715a055defdf1ea742d8f366bf151c2f9e3d53c8dd8
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 894ea36449b36aa395cf49c2f9ab9e14da774086eeb4053ad62863aed043e557
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b31a6c1fca119c32b152f27ea6c39bfb31f93fb1e0ef14ced40909e763ec9615
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 f2702307078a0821c4d705d6cb776719896af36b9ff79ce7c7ecab2436ecb4d7
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 ee1c320609dcc4a291dfccc29270658af137c2343c90aee01fc259607335ff50
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 74d1c2c06adcbd86daa16f8487862b7406690e9f9bb7d95d0a071a6e4e2b012c
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 a6b7e91d034c26825f3ec4c71ccef8e3aada9edfc434b574081ad3490f31c694
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 2b61058ab688531ed2358d83be7f9d6e1aa7ff4d40d733a02bf266c97e348e73
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 c0715287b99e85b267e6e63db7755ff9d9d0f884cc0ff60fb3b06a7ce13d6669
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 35537217c1378d90cdedc31fdb9d2248c6a485f391e0acf1ecb7c8fb543cf363
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 9ffc513638395e4fad9c88c940d64b3f70b2423724275bd883e6942d349c3749
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 1522dd28fe17ca5a12ab611b12455a006fbab5a62607f8ae2e7d679ee4964c54
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 3bf3e77039e0f6dc2acf81f89ed26bd372190babf3d59a6b82b1d5ca6a256587
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 1ed316545499c5a6586ccd0c7f2124d5cd63a18db848be9bee9d6d9bb183ff3d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 a2b6f96b8fe42734eb62b0fc71c5bc1cf87579e6ab982a3d0164edb0c66c5b59
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b2e8049835de23eaf09b4f2fb713c84662c263379a7e35fa08010a85a5b6a499
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 a3c63254be6a7cb54258e19f067ebcc338dad948ea035272cdc1051a2b9d3eb6
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 ca780100f738125d794d52605f751cdc41a83fa21f7fae19aa0b1ca1afc16ac8
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 4836f2f34f1b34f414f453f91f1c209ecf7f89fec40b11602bd4ec099bfc5765
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 43f2c288a9faecf7d4ce97129c5462c11c3e9566a7bcc7900747e815e3a50d0b
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\eb13dc9ff4a6d02f34da78c42721a52d99be32771e35611b967c7c0180426be7.lnk
                                                                                                                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 9e3e13f1c51dee903c7461ab555f2ec125ddcb4099abab91cb070177d66eac43
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          memory/828-210-0x0000000003550000-0x0000000003691000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/832-1163-0x0000000003730000-0x0000000003871000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/2624-128-0x0000000002FF0000-0x0000000003131000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/2644-183-0x00000000036E0000-0x0000000003821000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3148-157-0x00000000034A0000-0x00000000035E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3432-1525-0x0000000003630000-0x0000000003771000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-9-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-14-0x0000000000F70000-0x0000000000F71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-133-0x0000000001040000-0x0000000001041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-22-0x0000000001040000-0x0000000001041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-10-0x0000000000F60000-0x0000000000F61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-11-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-15-0x0000000000F90000-0x0000000000F91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-12-0x0000000000F50000-0x0000000000F51000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-13-0x0000000000F80000-0x0000000000F81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3460-2-0x00000000032A0000-0x00000000033E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3556-101-0x0000000003370000-0x00000000034B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/3808-71-0x00000000037D0000-0x0000000003911000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-51-0x0000000001350000-0x0000000001351000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-40-0x0000000001370000-0x0000000001371000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-31-0x00000000030C0000-0x0000000003201000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-45-0x0000000001300000-0x0000000001301000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-44-0x00000000012D0000-0x00000000012D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-55-0x00000000036B0000-0x00000000036B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-303-0x00000000036B0000-0x00000000036B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-43-0x0000000001360000-0x0000000001361000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-46-0x00000000012F0000-0x00000000012F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4040-42-0x00000000012E0000-0x00000000012E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4080-1380-0x00000000036E0000-0x0000000003821000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4664-687-0x0000000002EF0000-0x0000000003031000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/4708-238-0x0000000002E60000-0x0000000002FA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5176-962-0x0000000002D80000-0x0000000002EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5192-264-0x0000000003080000-0x00000000031C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5224-347-0x0000000003950000-0x0000000003A91000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5620-1550-0x0000000002FA0000-0x00000000030E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5660-291-0x0000000003280000-0x00000000033C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/5956-319-0x0000000002D30000-0x0000000002E71000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6012-373-0x0000000000E00000-0x0000000000F41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6020-400-0x0000000003460000-0x00000000035A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6220-427-0x0000000003060000-0x00000000031A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6360-1332-0x0000000002F70000-0x00000000030B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6464-502-0x0000000002EB0000-0x0000000002FF1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6660-454-0x0000000003090000-0x00000000031D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6672-548-0x0000000003010000-0x0000000003151000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/6996-525-0x0000000003560000-0x00000000036A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7032-479-0x0000000003890000-0x00000000039D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7108-571-0x0000000003BE0000-0x0000000003D21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7188-594-0x0000000002FD0000-0x0000000003111000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7276-732-0x0000000003130000-0x0000000003271000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7456-617-0x0000000003290000-0x00000000033D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7600-778-0x00000000036B0000-0x00000000037F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7736-709-0x00000000038E0000-0x0000000003A21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7760-640-0x00000000037B0000-0x00000000038F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/7940-755-0x0000000003BE0000-0x0000000003D21000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8024-663-0x0000000003BA0000-0x0000000003CE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8372-802-0x00000000035F0000-0x0000000003731000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8552-893-0x0000000003160000-0x00000000032A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8672-824-0x0000000003B60000-0x0000000003CA1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8756-940-0x0000000003370000-0x00000000034B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/8936-848-0x0000000002D20000-0x0000000002E61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9052-916-0x0000000003460000-0x00000000035A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9212-870-0x00000000033F0000-0x0000000003531000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9292-985-0x00000000032C0000-0x0000000003401000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9412-1077-0x0000000003A70000-0x0000000003BB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9620-1008-0x00000000033D0000-0x0000000003511000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9684-1101-0x0000000003030000-0x0000000003171000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9716-1146-0x0000000003330000-0x0000000003471000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9848-1031-0x0000000003430000-0x0000000003571000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/9932-1346-0x0000000003550000-0x0000000003691000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10112-1054-0x00000000039A0000-0x0000000003AE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10184-1113-0x0000000003560000-0x00000000036A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10252-1192-0x0000000003920000-0x0000000003A61000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10512-1215-0x00000000034D0000-0x0000000003611000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10564-1284-0x0000000003500000-0x0000000003641000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/10888-1238-0x0000000002E90000-0x0000000002FD1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11148-1308-0x0000000003030000-0x0000000003171000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11156-1262-0x00000000034B0000-0x00000000035F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11344-1404-0x0000000003250000-0x0000000003391000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11684-1428-0x00000000037C0000-0x0000000003901000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11772-1501-0x00000000034F0000-0x0000000003631000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/11876-1442-0x0000000003460000-0x00000000035A1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                          memory/12216-1476-0x00000000031F0000-0x0000000003331000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download