gh0strat | 10684e936304513c8e59ca562bc908e0ff23cfd53c44a0ff2b557415113b376d

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Packed.Win32.Black.d.exe
Size 441KB
Sample261013-bve7pscy7x
SHA256 10684e936304513c8e59ca562bc908e0ff23cfd53c44a0ff2b557415113b376d
MD5 1b07909aec590e342f4bac1c03224b98
SHA1 26d6dde708374fc1d32100939850fbbbfb1252a2
SHA512 470832716a41aa98fc63e4f3a25364f9af3daf81de532431f1d16454305d752daa075926ede6c66b095e148d94c33a675c1f6148ca8fcfb23f093ccdf6bd9d06
SSDEEP 6144:I6AP1No0gm+7ZhF2idZecnl20lHRxp3g3JAu3lZ0HULBAQ/irWTg87bt/+sxU:UPvobPFbF3Z4mxx43lZWsBp/irn84sxU
TLSH
T1A1A422470708647BED825F7494F2E43BCD22E7889EED16AFC0B7C1E21E567643B6160A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 24 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4b5-33.dat	family_gh0strat
behavioral2/memory/4464-35-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x001000000001c4b5-44.dat	family_gh0strat
behavioral2/memory/4464-47-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002300000001c4bc-52.dat	family_gh0strat
behavioral2/memory/4464-53-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002500000001c4bc-61.dat	family_gh0strat
behavioral2/memory/4464-65-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002700000001c4bc-69.dat	family_gh0strat
behavioral2/memory/4464-72-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002900000001c4bc-77.dat	family_gh0strat
behavioral2/memory/4464-79-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002b00000001c4bc-86.dat	family_gh0strat
behavioral2/memory/4464-90-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002d00000001c4bc-94.dat	family_gh0strat
behavioral2/memory/4464-97-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x002f00000001c4bc-102.dat	family_gh0strat
behavioral2/memory/4464-104-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x003100000001c4bc-111.dat	family_gh0strat
behavioral2/memory/4464-115-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x003300000001c4bc-119.dat	family_gh0strat
behavioral2/memory/4464-123-0x0000000000400000-0x0000000000486000-memory.dmp	family_gh0strat
behavioral2/files/0x003500000001c4bc-127.dat	family_gh0strat
behavioral2/files/0x003500000001c4bc-128.dat	family_gh0strat

Loads dropped DLL 34 IoCs

pid	Process
940	svchost.exe
4328	svchost.exe
3516	svchost.exe
5520	svchost.exe
5740	svchost.exe
4248	svchost.exe
4676	svchost.exe
5560	svchost.exe
2872	svchost.exe
2104	svchost.exe
6092	svchost.exe
3984	svchost.exe
1312	svchost.exe
3312	svchost.exe
3360	svchost.exe
4752	svchost.exe
2220	svchost.exe
1512	svchost.exe
1228	svchost.exe
3204	svchost.exe
6052	svchost.exe
4944	svchost.exe
4468	svchost.exe
3016	svchost.exe
2532	svchost.exe
2312	svchost.exe
4748	svchost.exe
3428	svchost.exe
2432	svchost.exe
5564	svchost.exe
4272	svchost.exe
724	svchost.exe
5160	svchost.exe
268	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\NetMeeting\%SESSIONNAME%\odhll.pic	jaffacakes118_Packed.Win32.Black.d.exe

Program crash 33 IoCs

pid	pid_target	Process	procid_target
2772	940	WerFault.exe	89
5832	4328	WerFault.exe	95
5960	3516	WerFault.exe	98
5100	5520	WerFault.exe	101
4992	5740	WerFault.exe	104
3428	4248	WerFault.exe	107
4668	4676	WerFault.exe	111
5920	5560	WerFault.exe	114
1708	2872	WerFault.exe	117
4312	2104	WerFault.exe	120
2396	6092	WerFault.exe	123
4316	3984	WerFault.exe	126
3504	1312	WerFault.exe	129
848	3312	WerFault.exe	132
5464	3360	WerFault.exe	135
4952	4752	WerFault.exe	138
3384	2220	WerFault.exe	141
1152	1512	WerFault.exe	144
5284	1228	WerFault.exe	147
1568	3204	WerFault.exe	150
3032	6052	WerFault.exe	153
3848	4944	WerFault.exe	156
2988	4468	WerFault.exe	159
2932	3016	WerFault.exe	162
200	2532	WerFault.exe	165
2692	2312	WerFault.exe	168
5848	4748	WerFault.exe	171
2388	3428	WerFault.exe	174
2436	2432	WerFault.exe	177
4336	5564	WerFault.exe	180
1112	4272	WerFault.exe	183
5964	724	WerFault.exe	186
5428	5160	WerFault.exe	189

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Packed.Win32.Black.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4464	jaffacakes118_Packed.Win32.Black.d.exe
4464	jaffacakes118_Packed.Win32.Black.d.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeBackupPrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe
Token: SeRestorePrivilege	4464	jaffacakes118_Packed.Win32.Black.d.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Black.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Black.d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 644
  2⤵
  - Program crash
  PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 940 -ip 940
1⤵
PID:1716

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 644
  2⤵
  - Program crash
  PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4328 -ip 4328
1⤵
PID:5748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 644
  2⤵
  - Program crash
  PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 3516 -ip 3516
1⤵
PID:2924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 644
  2⤵
  - Program crash
  PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5520 -ip 5520
1⤵
PID:800

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 644
  2⤵
  - Program crash
  PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5740 -ip 5740
1⤵
PID:4748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ias
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 644
  2⤵
  - Program crash
  PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4248 -ip 4248
1⤵
PID:4956

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 644
  2⤵
  - Program crash
  PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4676 -ip 4676
1⤵
PID:5564

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 644
  2⤵
  - Program crash
  PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5560 -ip 5560
1⤵
PID:5768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 644
  2⤵
  - Program crash
  PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2872 -ip 2872
1⤵
PID:2064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 644
  2⤵
  - Program crash
  PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2104 -ip 2104
1⤵
PID:4552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 644
  2⤵
  - Program crash
  PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6092 -ip 6092
1⤵
PID:5160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 644
  2⤵
  - Program crash
  PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3984 -ip 3984
1⤵
PID:2500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 644
  2⤵
  - Program crash
  PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1312 -ip 1312
1⤵
PID:2792

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 644
  2⤵
  - Program crash
  PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3312 -ip 3312
1⤵
PID:4528

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 644
  2⤵
  - Program crash
  PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3360 -ip 3360
1⤵
PID:4108

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 644
  2⤵
  - Program crash
  PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4752 -ip 4752
1⤵
PID:2900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 644
  2⤵
  - Program crash
  PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2220 -ip 2220
1⤵
PID:4640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s nwcworkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 644
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1512 -ip 1512
1⤵
PID:964

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 644
  2⤵
  - Program crash
  PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1228 -ip 1228
1⤵
PID:5672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 644
  2⤵
  - Program crash
  PID:1568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3204 -ip 3204
1⤵
PID:1176

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s srservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6052 -s 644
  2⤵
  - Program crash
  PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6052 -ip 6052
1⤵
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 644
  2⤵
  - Program crash
  PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4944 -ip 4944
1⤵
PID:2012

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 644
  2⤵
  - Program crash
  PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4468 -ip 4468
1⤵
PID:2508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmi
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 644
  2⤵
  - Program crash
  PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3016 -ip 3016
1⤵
PID:3120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 644
  2⤵
  - Program crash
  PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2532 -ip 2532
1⤵
PID:5960

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 644
  2⤵
  - Program crash
  PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2312 -ip 2312
1⤵
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s wmdmpmsp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 644
  2⤵
  - Program crash
  PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4748 -ip 4748
1⤵
PID:6112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 644
  2⤵
  - Program crash
  PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3428 -ip 3428
1⤵
PID:3144

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 644
  2⤵
  - Program crash
  PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2432 -ip 2432
1⤵
PID:1408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s logonhours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 644
  2⤵
  - Program crash
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5564 -ip 5564
1⤵
PID:4212

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 644
  2⤵
  - Program crash
  PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4272 -ip 4272
1⤵
PID:4540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 724 -s 644
  2⤵
  - Program crash
  PID:5964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 724 -ip 724
1⤵
PID:3248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s pcaudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 644
  2⤵
  - Program crash
  PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5160 -ip 5160
1⤵
PID:1116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

odhll.pic

Path C:\Program Files (x86)\NetMeeting\%SESSIONNAME%\odhll.pic
Size 10.9MB
SHA256 b86cd23972e92894f374d6891e8478895485436dd3741544a5b684a1c4877b2a
MD5 b4e699c9d3fc6e31a4267ab9442b5710
SHA1 c6977c10f7ce68351ce32cd2bec354f041368dc8
SHA512 4fc428d88657f48f3e5819cac946ff8dec9f282ee04413267f17f42ef7b0da3ded6acd025a572a461946001b1896d75eca08e39bd7154cdca47e4f7d41990e43
SSDEEP 3072:IM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6k:PufycvlulkdOur/IBTBlRUtnIL
TLSH
T169B68D03F68144FAE6552CBC14AD733EAB3F969887495AD3F364DF640423211E7263AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 22.1MB
SHA256 58e2d4b091a451b9e5ad8cbeb4366c3dcd828a0187e887ba69011c6f96ae48a9
MD5 456c78abd2623b94ebddc8c0befc10dc
SHA1 34a6fecc9631304fb2d060f5c09305730c13c4f3
SHA512 f2d79e4f65d78f2d9d2be708168af2c30b93c77300404381c87eb0188885f44902314570bedb7c6104bbc2ce82b27eba280616b82314d526aa1b2d2524c6f784
SSDEEP 6144:MufycvlulkdOur/IBTBlRUtnILXlulkdOU:Tf1ndOuLIBT3bdOU
TLSH
T168378D03E68144FDE2556CBC20AD773AAB3F97A887495AD3F368DF740423211D7262A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 19.1MB
SHA256 f638c8b6a80b654b5a8e66239738b1f65268e79b7318b86072a926be1e11b12d
MD5 de6c417847bc8a549c5908923c4aacdd
SHA1 c026fa0e52bb6883e6d8bafba0e8b0a856a4df5e
SHA512 23eaf129abf858bd4836eb587f8f202c1a3e05bfb7732f24b9fedcb427865e1ee709c81aa373954c05d2b2d0931867775f2b9f65a72ae892ed2cee405a4066ce
SSDEEP 6144:RufycvlulkdOur/IBTBlRUtnILcr/IBTBlRUtnd:Mf1ndOuLIBT3gLIBT3O
TLSH
T1C9179D03B6C144FAE6692C7C10ED633EA73BA6598B055AD3F358EF250422251E7353EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 19.1MB
SHA256 c2b1c62bf88503878295dd174f8ee12c9814ce0eba0d74bc7b336e7b6fb31275
MD5 fc3d20442473fa16db533cdc06ce74fb
SHA1 e09fcb1663a092122677bad7484bc979887c0e47
SHA512 4c01d85d0374627d49927cf19cece12aeec2078d86ae73e77952b2a3dcfca61d10d482712127884d92d7b1d6f3cb7512c0dc3cfc2bfc8410e21095f496540bcf
SSDEEP 6144:CufycvlulkdOur/IBTBlRUtnILadOur/:Nf1ndOuLIBT3WdOuL
TLSH
T109177C03A68144FDE6952CBC10AD733FAB3F8BA887095AD3F354EF654423251D7262A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 20.0MB
SHA256 459494d8b6e5bf261defba3eeaba349fa489a48e707b1db3e842b0db6cf3ce7f
MD5 8d60ec22d67f0664ad9e43355c245545
SHA1 b36e7022489956fe3ffed09d3bc1937510bf9b8e
SHA512 58b1a94b5a3e980c970d5a39a6e3d9dc0c354aaf47e9dca35ad18709b42b7b95155228c1ba4a265769a6cbfa62783ff643b17748d3cedb74ef81e5dc6d78d17b
SSDEEP 3072:AM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6kZwVVyco:nufycvlulkdOur/IBTBlRUtnILSfyco
TLSH
T105278E03E6C144F9E6552C7C10AD733B9B3F9A9987099AD3F364EF650423212D72A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 22.0MB
SHA256 e81ddb8fa3aac8954e0ab2e6415f3eb07cb85e64805e8ccf2f1e7950fe5f6777
MD5 601ebdd2c2a61087008236e6b7219fba
SHA1 334e606742ef9a4c29e6a460ae190a4aed2be77d
SHA512 d07aee640e7a6381b521829ff1eceb75ddff47c78f937fefdce28838029e8e4e093f3f3d885954b11b850951dcc89f9f2b9ad8230616c71f306d754f2ebe513c
SSDEEP 3072:vM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6kRwVVyck:UufycvlulkdOur/IBTBlRUtnILafyck
TLSH
T141378E03E6C144F9E6552C7C10AD733B9B3F9A9987095AD3F364EF650423212E72A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 21.1MB
SHA256 cd1b1308a791a166bdbcf9c819bf44c32c0f334e52dbf93c85bd28fcecae5d18
MD5 b823249c54c880d63d95050c74a26ca1
SHA1 9b387d09d863a349654097ec4847de31237c2150
SHA512 a22438ef3782e78843e2209fa96f7da2d22a5c5eb9fcfb173d74e8112c9f49d3c80aee0a4ea16794beba5701496b6129b83bb4f4b4c6bd0f4c024ebb8c633421
SSDEEP 6144:tufycvlulkdOur/IBTBlRUtnILtlulkdi:Af1ndOuLIBT3xdi
TLSH
T10D278E03E68144FDE6566CBC24AD773A973F9BA887095AD3F368DF700423211D7262A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 23.0MB
SHA256 5ee8214e3bd57bd52810c1f208dd207c7dda59dbb9a5b10caa243b7c492d093f
MD5 dbf0b21a5c26b0a4767bf0c50a532119
SHA1 647ecfb45e358bbf07804219dc31806b9b09b568
SHA512 e9a841cb2806618aa5f8b782768057f3a49b7757986ecfaf027806b5298f8037ad0d3ca96e30b5a20dd93045c93535b2f0eccf4068c9d98f0dc284e7922d3dd0
SSDEEP 3072:CM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6kbM+k:ZufycvlulkdOur/IBTBlRUtnILIR
TLSH
T170378C03F68148FDE6562C7C24AD633E9B3F969987095AD3F364DF640423211DB293AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 19.0MB
SHA256 175a4492d129b299848b76ad0834c07867eb647146b522cd2acb8966d336d1fd
MD5 e705d0d42cf21d929446afbb778b7145
SHA1 144be5c8173dbfc5cc2e6f18e194cc02112a59b9
SHA512 c786b031f2f91316661148f8821db978e88ae37b8b57b61c954566d6dcfd8fb893242462cb9770fd5d174663ed09c5865cbeb12d7fee0c64492a8bcff71b4e29
SSDEEP 3072:sM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6kGwVVycn:7ufycvlulkdOur/IBTBlRUtnILpfycn
TLSH
T13D179E03E6C144F9E6552D7C10AD733B9B3F9A9987095AD3F324EF650423212E7293AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 21.1MB
SHA256 208fb04490eb27f72b12fd41152d1f333997df41857cf6645398fb2d57c36fa0
MD5 83772dab3992a93f10ba3cc6cd1a8c47
SHA1 39c7df8d48b0c6cdb1e1eb9a34dbad852a989819
SHA512 e4bf9901b19271ea88e8a6ab6e3647a0602b061f4e1fc7a506a2300a81913a59d838fa7e7b5a81ca58f6565ae022e755e015f07016d744cd07acd04e0a45ed33
SSDEEP 6144:9ufycvlulkdOur/IBTBlRUtnILGr/IBTBl/:wf1ndOuLIBT3qLIBT3/
TLSH
T197278D03B6C144FAE6A52C7C10ED673EA73B96588B495AD3F358EF240423251E7253EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 20.1MB
SHA256 bb076c7b7860f1443e391b4f45245508397749374eb208bcfe74f5e14a5c3a18
MD5 a9e1c88402fd67b3589d5f89d6f07eb2
SHA1 efac2e4a74163f485deab01d2fb0843ba14c9eb2
SHA512 b4852488eb8f3b7fda457d819fc815c2c3e5313f58d26e79b0026b160d0628e95e6b1aa6dd4e0b4e798a73107112497b2fae72ae612e6032555bce4b583f0ca5
SSDEEP 6144:KufycvlulkdOur/IBTBlRUtnIL3dOur//:1f1ndOuLIBT3LdOuL/
TLSH
T166277C03A68144FDE6952CBC10AD673FAB3F9BA887095AD3F364EF750423211D726267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 19.0MB
SHA256 b22a0d52ca0c0ef249f28ee4c4564b88175499c3d3661674bf51c70025536949
MD5 b5d73bb789aaf33a79a06c13246c40eb
SHA1 b2e43a1f396ce70414be8b349d817260283dc885
SHA512 5549e261ff2582bd1bba47d00e072a5ba09ce2978bdc3b1d4584eeec5a0502631571aec71d89bc7b28c02305a3faf302a7bf2afaa6dd2a32c88b177db37cb966
SSDEEP 6144:4ufycvlulkdOur/IBTBlRUtnIL5ycvlul3:Xf1ndOuLIBT3d1s
TLSH
T1EA179E03E68144F9E6552CBC14AE733B9B3F979987095AD3F368DF600423211E72A3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

odhll.pic

Path \??\c:\program files (x86)\netmeeting\%sessionname%\odhll.pic
Size 18.5MB
SHA256 983906d847680e4709a5611d31bbcf4a9c0c7f973e876606baa541e2ef9d1dc8
MD5 5837b29497f27bf48a632bae94d495ae
SHA1 f49a2b54c146d5ef009355e92ba7bc201198cc7d
SHA512 d0c24322e642e6e3e30250319a1ce62f344d03fe3177d41f72201c9d8ca2b0ded7386273cc73e8eaa7979fd9fa56c43c8f7cfe8f6a69cbdbccca2ac37e22f893
SSDEEP 3072:IM+4wVVycN5lulnkdfmZElDNlt9RrmdBTBftRUe+nIL6k:PufycvlulkdOur/IBTBlRUtnIL
TLSH
T145178D03F68144FAE6552CBC14AD733EAB3F969887495AD3F364DF640423211E7263AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-5-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/4464-25-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/4464-17-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-16-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-15-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-14-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-13-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-12-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-11-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-10-0x0000000002460000-0x0000000002461000-memory.dmp

Download

memory/4464-9-0x00000000024D0000-0x00000000024D1000-memory.dmp

Download

memory/4464-8-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/4464-7-0x00000000024B0000-0x00000000024B1000-memory.dmp

Download

memory/4464-6-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/4464-4-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-2-0x0000000002490000-0x0000000002491000-memory.dmp

Download

memory/4464-23-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-35-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-38-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/4464-37-0x0000000000B20000-0x0000000000B74000-memory.dmp

Download

memory/4464-18-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-47-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-24-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/4464-53-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-26-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/4464-65-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-27-0x0000000003460000-0x0000000003461000-memory.dmp

Download

memory/4464-72-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-28-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/4464-79-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-29-0x0000000003420000-0x0000000003422000-memory.dmp

Download

memory/4464-90-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-22-0x0000000003480000-0x0000000003481000-memory.dmp

Download

memory/4464-97-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-21-0x0000000003430000-0x0000000003432000-memory.dmp

Download

memory/4464-104-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-19-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/4464-115-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-20-0x0000000003430000-0x0000000003431000-memory.dmp

Download

memory/4464-123-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/4464-3-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/4464-1-0x0000000000B20000-0x0000000000B74000-memory.dmp

Download