Analysis
- max time kernel
32s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/08/2026, 20:58
General
- Target b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exe
- Size 1022KB
- Sample260830-zshf2shn21
- SHA256 b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 31 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 30 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 31 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of AdjustPrivilegeToken 30 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 30 IoCs
- Suspicious use of SetWindowsHookEx 62 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exe"C:\Users\Admin\AppData\Local\Temp\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exe"1⤵
- Creates a file in the Startup directory
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 29682⤵
- Program crash
-
-
C:\PROGRA~3\{A1FF9~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A1FF9~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 29562⤵
- Program crash
-
-
C:\PROGRA~3\{49BC2~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{49BC2~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 29562⤵
- Program crash
-
-
C:\PROGRA~3\{F6229~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{F6229~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 29842⤵
- Program crash
-
-
C:\PROGRA~3\{3BB88~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{3BB88~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 30002⤵
- Program crash
-
-
C:\PROGRA~3\{75E61~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{75E61~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 29882⤵
- Program crash
-
-
C:\PROGRA~3\{F4515~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{F4515~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 28962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4368 -ip 43681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4124 -ip 41241⤵
-
C:\PROGRA~3\{D1831~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D1831~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 29242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4228 -ip 42281⤵
-
C:\PROGRA~3\{2BAAE~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{2BAAE~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 29242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4028 -ip 40281⤵
-
C:\PROGRA~3\{E9D1D~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E9D1D~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 29682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4540 -ip 45401⤵
-
C:\PROGRA~3\{340D3~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{340D3~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 28402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1628 -ip 16281⤵
-
C:\PROGRA~3\{AAD3D~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{AAD3D~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 29162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5148 -ip 51481⤵
-
C:\PROGRA~3\{AE267~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{AE267~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 29482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5480 -ip 54801⤵
-
C:\PROGRA~3\{05109~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{05109~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 29522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5760 -ip 57601⤵
-
C:\PROGRA~3\{92E07~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{92E07~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5508 -s 13402⤵
- Program crash
-
-
C:\PROGRA~3\{C273E~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{C273E~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 29282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6036 -ip 60361⤵
-
C:\PROGRA~3\{45134~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{45134~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 29322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5508 -ip 55081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6000 -ip 60001⤵
-
C:\PROGRA~3\{D1E69~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D1E69~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 29322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5880 -ip 58801⤵
-
C:\PROGRA~3\{09A58~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{09A58~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6184 -s 28842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5560 -ip 55601⤵
-
C:\PROGRA~3\{6CD64~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{6CD64~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 28802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6184 -ip 61841⤵
-
C:\PROGRA~3\{5DDA1~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{5DDA1~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6736 -s 29602⤵
- Program crash
-
-
C:\PROGRA~3\{2942E~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{2942E~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 28642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 6444 -ip 64441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6736 -ip 67361⤵
-
C:\PROGRA~3\{D8268~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D8268~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6320 -s 29402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6968 -ip 69681⤵
-
C:\PROGRA~3\{7314B~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{7314B~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6824 -s 29322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6320 -ip 63201⤵
-
C:\PROGRA~3\{A93D9~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A93D9~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 29602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6824 -ip 68241⤵
-
C:\PROGRA~3\{925AE~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{925AE~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6480 -s 28842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6364 -ip 63641⤵
-
C:\PROGRA~3\{E95AA~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E95AA~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 28602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6480 -ip 64801⤵
-
C:\PROGRA~3\{AC563~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{AC563~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7396 -s 29362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4032 -ip 40321⤵
-
C:\PROGRA~3\{6D335~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{6D335~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7684 -s 29442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7396 -ip 73961⤵
-
C:\PROGRA~3\{A2E1D~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A2E1D~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8000 -s 28842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 7684 -ip 76841⤵
-
C:\PROGRA~3\{0E08C~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{0E08C~1\B13BC6~1.EXE1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7368 -s 28762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8000 -ip 80001⤵
-
C:\PROGRA~3\{010AF~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{010AF~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 412 -s 29682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 7368 -ip 73681⤵
-
C:\PROGRA~3\{57212~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{57212~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7356 -s 29482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 412 -ip 4121⤵
-
C:\PROGRA~3\{C419A~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{C419A~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 29442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7356 -ip 73561⤵
-
C:\PROGRA~3\{1546B~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{1546B~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 29482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8140 -ip 81401⤵
-
C:\PROGRA~3\{FF712~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{FF712~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8436 -s 28962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3740 -ip 37401⤵
-
C:\PROGRA~3\{32E84~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{32E84~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8664 -s 29322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 8436 -ip 84361⤵
-
C:\PROGRA~3\{AC0AE~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{AC0AE~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 29682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8664 -ip 86641⤵
-
C:\PROGRA~3\{79B9E~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{79B9E~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 29522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 8952 -ip 89521⤵
-
C:\PROGRA~3\{65A77~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{65A77~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8600 -s 28682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 8204 -ip 82041⤵
-
C:\PROGRA~3\{B2991~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{B2991~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8916 -s 28882⤵
- Program crash
-
-
C:\PROGRA~3\{46F68~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{46F68~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8568 -s 29442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8916 -ip 89161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8600 -ip 86001⤵
-
C:\PROGRA~3\{29BCF~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{29BCF~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8728 -s 28762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8568 -ip 85681⤵
-
C:\PROGRA~3\{1517F~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{1517F~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8512 -s 29522⤵
- Program crash
-
-
C:\PROGRA~3\{FFDE9~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{FFDE9~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9408 -s 29322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8728 -ip 87281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8512 -ip 85121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 9408 -ip 94081⤵
-
C:\PROGRA~3\{10BB1~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{10BB1~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9760 -s 29882⤵
-
-
C:\PROGRA~3\{B351D~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{B351D~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9992 -s 28962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3496 -ip 34961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3792 -ip 37921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9992 -ip 99921⤵
-
C:\PROGRA~3\{A6829~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A6829~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 29562⤵
- Program crash
-
-
C:\PROGRA~3\{10B23~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{10B23~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 29162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 9532 -ip 95321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9972 -ip 99721⤵
-
C:\PROGRA~3\{C31FC~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{C31FC~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 29522⤵
- Program crash
-
-
C:\PROGRA~3\{0A8A6~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{0A8A6~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9332 -s 28682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2764 -ip 27641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 9332 -ip 93321⤵
-
C:\PROGRA~3\{A8272~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A8272~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 29442⤵
- Program crash
-
-
C:\PROGRA~3\{58286~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{58286~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10364 -s 29402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6264 -ip 62641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 10364 -ip 103641⤵
-
C:\PROGRA~3\{64BEE~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{64BEE~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10748 -s 29402⤵
- Program crash
-
-
C:\PROGRA~3\{99C49~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{99C49~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11032 -s 29362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10748 -ip 107481⤵
-
C:\PROGRA~3\{28125~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{28125~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11228 -s 28442⤵
- Program crash
-
-
C:\PROGRA~3\{0A9D9~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{0A9D9~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 28842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 11032 -ip 110321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 11228 -ip 112281⤵
-
C:\PROGRA~3\{0BE1E~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{0BE1E~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11156 -s 29282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2204 -ip 22041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 11156 -ip 111561⤵
-
C:\PROGRA~3\{EB1E7~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{EB1E7~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 29322⤵
- Program crash
-
-
C:\PROGRA~3\{930E4~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{930E4~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 29362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4180 -ip 41801⤵
-
C:\PROGRA~3\{303A1~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{303A1~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 28522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4496 -ip 44961⤵
-
C:\PROGRA~3\{E184C~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E184C~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11388 -s 28602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4888 -ip 48881⤵
-
C:\PROGRA~3\{A2823~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A2823~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11672 -s 29442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 11388 -ip 113881⤵
-
C:\PROGRA~3\{164F3~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{164F3~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11988 -s 28642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 11672 -ip 116721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 11988 -ip 119881⤵
-
C:\PROGRA~3\{38BCA~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{38BCA~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11276 -s 29242⤵
-
-
C:\PROGRA~3\{6E909~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{6E909~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 28962⤵
- Program crash
-
-
C:\PROGRA~3\{6860D~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{6860D~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12040 -s 29602⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6052 -ip 60521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 11276 -ip 112761⤵
-
C:\PROGRA~3\{E0B14~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E0B14~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11440 -s 28962⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 12040 -ip 120401⤵
-
C:\PROGRA~3\{E3E5B~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E3E5B~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5124 -s 29442⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 11440 -ip 114401⤵
-
C:\PROGRA~3\{A5521~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{A5521~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 29122⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5124 -ip 51241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 9760 -ip 97601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5188 -ip 51881⤵
-
C:\PROGRA~3\{6FB78~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{6FB78~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 28762⤵
-
-
C:\PROGRA~3\{8804E~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{8804E~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 29362⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5276 -ip 52761⤵
-
C:\PROGRA~3\{F4B66~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{F4B66~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12336 -s 29402⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5444 -ip 54441⤵
-
C:\PROGRA~3\{15FC6~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{15FC6~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12616 -s 29082⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 12336 -ip 123361⤵
-
C:\PROGRA~3\{31EF1~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{31EF1~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12900 -s 29362⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 12616 -ip 126161⤵
-
C:\PROGRA~3\{449D5~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{449D5~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13228 -s 28402⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12900 -ip 129001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 13228 -ip 132281⤵
-
C:\PROGRA~3\{8C3B0~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{8C3B0~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12724 -s 29362⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 12724 -ip 127241⤵
-
C:\PROGRA~3\{D1863~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D1863~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13108 -s 29402⤵
-
-
C:\PROGRA~3\{D2EE7~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D2EE7~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12404 -s 29642⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 13108 -ip 131081⤵
-
C:\PROGRA~3\{B751B~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{B751B~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 29162⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 12404 -ip 124041⤵
-
C:\PROGRA~3\{19737~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{19737~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 28842⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 34881⤵
-
C:\PROGRA~3\{F847C~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{F847C~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7832 -s 29402⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 456 -ip 4561⤵
-
C:\PROGRA~3\{E0BA0~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{E0BA0~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12700 -s 29082⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7832 -ip 78321⤵
-
C:\PROGRA~3\{CF2DD~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{CF2DD~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 29002⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 12700 -ip 127001⤵
-
C:\PROGRA~3\{D6045~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D6045~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13572 -s 29282⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3804 -ip 38041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 13572 -ip 135721⤵
-
C:\PROGRA~3\{95699~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{95699~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13896 -s 29602⤵
-
-
C:\PROGRA~3\{D5107~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{D5107~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14168 -s 29362⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 13896 -ip 138961⤵
-
C:\PROGRA~3\{8E6F1~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{8E6F1~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13440 -s 29162⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 14168 -ip 141681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 13440 -ip 134401⤵
-
C:\PROGRA~3\{BB3DE~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{BB3DE~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13924 -s 29082⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 13924 -ip 139241⤵
-
C:\PROGRA~3\{943B5~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{943B5~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13348 -s 29602⤵
-
-
C:\PROGRA~3\{FE44F~1\b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exeC:\PROGRA~3\{FE44F~1\B13BC6~1.EXE1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 13348 -ip 133481⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.dat
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.exe
background_gradient[1]
errorPageStrings[1]
ErrorPageTemplate[1]
bullet[1]
httpErrorPagesScripts[1]
info_48[1]
navcancl[1]
loader.gif
progressbar.gif
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
b13bc6f47531b39a1e53a05c1dd4c36c56df77769326f41e39830ae070d48033.lnk
memory/412-801-0x0000000002D00000-0x0000000002E41000-memory.dmp
memory/1628-264-0x0000000003430000-0x0000000003571000-memory.dmp
memory/2204-1380-0x0000000003550000-0x0000000003691000-memory.dmp
memory/2764-1215-0x0000000003260000-0x00000000033A1000-memory.dmp
memory/3496-128-0x00000000038B0000-0x00000000039F1000-memory.dmp
memory/3740-870-0x0000000003950000-0x0000000003A91000-memory.dmp
memory/3792-156-0x00000000037B0000-0x00000000038F1000-memory.dmp
memory/4028-210-0x0000000002E80000-0x0000000002FC1000-memory.dmp
memory/4032-686-0x0000000003870000-0x00000000039B1000-memory.dmp
memory/4124-42-0x00000000017C0000-0x00000000017C1000-memory.dmp
memory/4124-53-0x0000000003B60000-0x0000000003B61000-memory.dmp
memory/4124-47-0x0000000001800000-0x0000000001801000-memory.dmp
memory/4124-40-0x00000000017D0000-0x00000000017D1000-memory.dmp
memory/4124-31-0x0000000003560000-0x00000000036A1000-memory.dmp
memory/4124-303-0x0000000003B60000-0x0000000003B61000-memory.dmp
memory/4124-43-0x00000000017F0000-0x00000000017F1000-memory.dmp
memory/4124-41-0x0000000001810000-0x0000000001811000-memory.dmp
memory/4124-44-0x00000000017E0000-0x00000000017E1000-memory.dmp
memory/4124-39-0x0000000001820000-0x0000000001821000-memory.dmp
memory/4180-1431-0x0000000003B30000-0x0000000003C71000-memory.dmp
memory/4228-184-0x00000000031E0000-0x0000000003321000-memory.dmp
memory/4272-74-0x0000000003640000-0x0000000003781000-memory.dmp
memory/4368-11-0x0000000001A30000-0x0000000001A31000-memory.dmp
memory/4368-14-0x0000000001520000-0x0000000001521000-memory.dmp
memory/4368-9-0x0000000001A40000-0x0000000001A41000-memory.dmp
memory/4368-140-0x0000000001B40000-0x0000000001B41000-memory.dmp
memory/4368-13-0x0000000001530000-0x0000000001531000-memory.dmp
memory/4368-2-0x0000000003840000-0x0000000003981000-memory.dmp
memory/4368-10-0x0000000001510000-0x0000000001511000-memory.dmp
memory/4368-22-0x0000000001B40000-0x0000000001B41000-memory.dmp
memory/4368-12-0x0000000001500000-0x0000000001501000-memory.dmp
memory/4368-15-0x0000000001540000-0x0000000001541000-memory.dmp
memory/4388-101-0x0000000002DC0000-0x0000000002F01000-memory.dmp
memory/4496-1454-0x00000000034B0000-0x00000000035F1000-memory.dmp
memory/4540-237-0x0000000003500000-0x0000000003641000-memory.dmp
memory/4888-1479-0x00000000035E0000-0x0000000003721000-memory.dmp
memory/5148-291-0x00000000031E0000-0x0000000003321000-memory.dmp
memory/5480-319-0x0000000002F10000-0x0000000003051000-memory.dmp
memory/5508-397-0x0000000003B90000-0x0000000003CD1000-memory.dmp
memory/5560-479-0x0000000003090000-0x00000000031D1000-memory.dmp
memory/5760-346-0x00000000038E0000-0x0000000003A21000-memory.dmp
memory/5880-454-0x00000000031C0000-0x0000000003301000-memory.dmp
memory/6000-427-0x0000000003080000-0x00000000031C1000-memory.dmp
memory/6036-374-0x0000000003850000-0x0000000003991000-memory.dmp
memory/6184-503-0x00000000030A0000-0x00000000031E1000-memory.dmp
memory/6264-1261-0x0000000003B30000-0x0000000003C71000-memory.dmp
memory/6320-594-0x0000000002F90000-0x00000000030D1000-memory.dmp
memory/6364-640-0x0000000003110000-0x0000000003251000-memory.dmp
memory/6444-525-0x0000000003070000-0x00000000031B1000-memory.dmp
memory/6480-663-0x0000000003570000-0x00000000036B1000-memory.dmp
memory/6736-548-0x00000000031C0000-0x0000000003301000-memory.dmp
memory/6824-617-0x0000000003370000-0x00000000034B1000-memory.dmp
memory/6968-571-0x0000000003440000-0x0000000003581000-memory.dmp
memory/7356-824-0x0000000003970000-0x0000000003AB1000-memory.dmp
memory/7368-778-0x0000000003630000-0x0000000003771000-memory.dmp
memory/7396-710-0x0000000002EF0000-0x0000000003031000-memory.dmp
memory/7684-733-0x0000000002FB0000-0x00000000030F1000-memory.dmp
memory/8000-755-0x00000000031E0000-0x0000000003321000-memory.dmp
memory/8140-847-0x0000000003A70000-0x0000000003BB1000-memory.dmp
memory/8204-962-0x0000000003020000-0x0000000003161000-memory.dmp
memory/8436-893-0x0000000003AF0000-0x0000000003C31000-memory.dmp
memory/8512-1074-0x0000000003280000-0x00000000033C1000-memory.dmp
memory/8568-1032-0x0000000003230000-0x0000000003371000-memory.dmp
memory/8600-985-0x0000000003920000-0x0000000003A61000-memory.dmp
memory/8664-917-0x0000000003040000-0x0000000003181000-memory.dmp
memory/8728-1054-0x0000000003040000-0x0000000003181000-memory.dmp
memory/8916-998-0x00000000032E0000-0x0000000003421000-memory.dmp
memory/8952-939-0x00000000035A0000-0x00000000036E1000-memory.dmp
memory/9332-1238-0x0000000003BD0000-0x0000000003D11000-memory.dmp
memory/9408-1100-0x0000000002BE0000-0x0000000002D21000-memory.dmp
memory/9532-1169-0x00000000039F0000-0x0000000003B31000-memory.dmp
memory/9760-1123-0x0000000002E40000-0x0000000002F81000-memory.dmp
memory/9972-1192-0x0000000002D50000-0x0000000002E91000-memory.dmp
memory/9992-1146-0x0000000002DD0000-0x0000000002F11000-memory.dmp
memory/10364-1275-0x0000000002D80000-0x0000000002EC1000-memory.dmp
memory/10748-1308-0x0000000003780000-0x00000000038C1000-memory.dmp
memory/11032-1333-0x0000000003040000-0x0000000003181000-memory.dmp
memory/11156-1402-0x0000000002F70000-0x00000000030B1000-memory.dmp
memory/11228-1347-0x0000000003110000-0x0000000003251000-memory.dmp
memory/11388-1505-0x0000000003920000-0x0000000003A61000-memory.dmp
memory/11672-1529-0x0000000003350000-0x0000000003491000-memory.dmp
memory/11988-1554-0x0000000003820000-0x0000000003961000-memory.dmp