modiloader | 1fc078aab853bc4972b2e74e1f04879cd246668bdf120d210fd51a029c021c1c

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

In allegato il nuovo elenco ordini.exe
Size

967KB
MD5

af23007b78a02d5d5ad429880a505c9c
SHA1

fe82317e4682b0d23b457f26c2a3f6493e37a530
SHA256

1fc078aab853bc4972b2e74e1f04879cd246668bdf120d210fd51a029c021c1c
SHA512

849bdfc8e433cf07d75555895dc9eb6f766dc21f15e8d784a04e976723d05b8bb041e833553feb2e1f869ef9018dc489eb8e7e9d9d3d1929bea65d903c3db1a7
SSDEEP

12288:8HbINWvoTEQYJGl/iUfkcogKuqAJA+1z48qDo5ynuzFl2LUv0eMqnexYA1l/X:6b6ZeGBiAkcogKOi+1zSo5ynRxYA7/X

Score

10^/10

modiloader remcos remotehost persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

newehmpage.webredirect.org:5564

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
java1.exe
copy_folder
java1
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%SystemDrive%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
java1-3C0HZ3
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
java1
take_screenshot_option
false
take_screenshot_time
5

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ModiLoader Second Stage 64 IoCs

resource	yara_rule
behavioral2/memory/2348-132-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-134-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-133-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-135-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-136-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-138-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-137-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-139-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-141-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-140-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-142-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-143-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-144-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-145-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-146-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-147-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-148-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-149-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-150-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-151-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-153-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-154-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-155-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-152-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-157-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-158-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-156-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-159-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-160-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-162-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-161-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-163-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-164-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-165-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-166-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-167-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-168-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-169-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-170-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-171-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-172-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-173-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-174-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-175-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-176-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-177-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-178-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-179-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-180-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-181-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-182-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-183-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-184-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-185-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-186-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-187-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-188-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-190-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-189-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-191-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-192-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-193-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-194-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2
behavioral2/memory/2348-195-0x00000000024C0000-0x0000000002521000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
784	java1.exe
4048	java1.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	In allegato il nuovo elenco ordini.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	In allegato il nuovo elenco ordini.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	java1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	java1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java1 = "\"C:\\java1\\java1.exe\""	java1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pwbfokry = "C:\\Users\\Public\\Libraries\\yrkofbwP.url"	In allegato il nuovo elenco ordini.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	In allegato il nuovo elenco ordini.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java1 = "\"C:\\java1\\java1.exe\""	In allegato il nuovo elenco ordini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\java1 = "\"C:\\java1\\java1.exe\""	In allegato il nuovo elenco ordini.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java1 = "\"C:\\java1\\java1.exe\""	java1.exe

Suspicious use of SetThreadContext 32 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 4048 set thread context of 1764	4048	java1.exe	105
PID 4048 set thread context of 1948	4048	java1.exe	111
PID 4048 set thread context of 1856	4048	java1.exe	116
PID 4048 set thread context of 4952	4048	java1.exe	121
PID 4048 set thread context of 1736	4048	java1.exe	126
PID 4048 set thread context of 1956	4048	java1.exe	131
PID 4048 set thread context of 2460	4048	java1.exe	136
PID 4048 set thread context of 4360	4048	java1.exe	141
PID 4048 set thread context of 1476	4048	java1.exe	146
PID 4048 set thread context of 1092	4048	java1.exe	152
PID 4048 set thread context of 4756	4048	java1.exe	157
PID 4048 set thread context of 636	4048	java1.exe	162
PID 4048 set thread context of 3304	4048	java1.exe	167
PID 4048 set thread context of 3548	4048	java1.exe	172
PID 4048 set thread context of 2408	4048	java1.exe	177
PID 4048 set thread context of 3912	4048	java1.exe	182
PID 4048 set thread context of 4368	4048	java1.exe	187
PID 4048 set thread context of 2072	4048	java1.exe	192
PID 4048 set thread context of 3780	4048	java1.exe	197
PID 4048 set thread context of 1740	4048	java1.exe	202
PID 4048 set thread context of 4292	4048	java1.exe	207
PID 4048 set thread context of 3660	4048	java1.exe	212
PID 4048 set thread context of 3112	4048	java1.exe	217
PID 4048 set thread context of 3060	4048	java1.exe	222
PID 4048 set thread context of 4092	4048	java1.exe	227
PID 4048 set thread context of 756	4048	java1.exe	232
PID 4048 set thread context of 8	4048	java1.exe	237
PID 4048 set thread context of 4772	4048	java1.exe	242
PID 4048 set thread context of 208	4048	java1.exe	247
PID 4048 set thread context of 3952	4048	java1.exe	252
PID 4048 set thread context of 4560	4048	java1.exe	257

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 62 IoCs

pid	pid_target	Process	procid_target
948	1764	WerFault.exe	105
2192	1764	WerFault.exe	105
4652	1948	WerFault.exe	111
1388	1948	WerFault.exe	111
4996	1856	WerFault.exe	116
4388	1856	WerFault.exe	116
1164	4952	WerFault.exe	121
2112	4952	WerFault.exe	121
4644	1736	WerFault.exe	126
4796	1736	WerFault.exe	126
4368	1956	WerFault.exe	131
1440	1956	WerFault.exe	131
444	2460	WerFault.exe	136
5064	2460	WerFault.exe	136
4856	4360	WerFault.exe	141
3140	4360	WerFault.exe	141
4376	1476	WerFault.exe	146
2976	1476	WerFault.exe	146
3644	1092	WerFault.exe	152
484	1092	WerFault.exe	152
2996	4756	WerFault.exe	157
540	4756	WerFault.exe	157
2716	636	WerFault.exe	162
4496	636	WerFault.exe	162
2784	3304	WerFault.exe	167
812	3304	WerFault.exe	167
2116	3548	WerFault.exe	172
4244	3548	WerFault.exe	172
1488	2408	WerFault.exe	177
432	2408	WerFault.exe	177
4904	3912	WerFault.exe	182
752	3912	WerFault.exe	182
2268	4368	WerFault.exe	187
2456	4368	WerFault.exe	187
5100	2072	WerFault.exe	192
4720	2072	WerFault.exe	192
2332	3780	WerFault.exe	197
1468	3780	WerFault.exe	197
4544	1740	WerFault.exe	202
3772	1740	WerFault.exe	202
2588	4292	WerFault.exe	207
2316	4292	WerFault.exe	207
4968	3660	WerFault.exe	212
3028	3660	WerFault.exe	212
4740	3112	WerFault.exe	217
4416	3112	WerFault.exe	217
2784	3060	WerFault.exe	222
812	3060	WerFault.exe	222
3556	4092	WerFault.exe	227
1944	4092	WerFault.exe	227
2428	756	WerFault.exe	232
4340	756	WerFault.exe	232
4280	8	WerFault.exe	237
4408	8	WerFault.exe	237
2476	4772	WerFault.exe	242
444	4772	WerFault.exe	242
1580	208	WerFault.exe	247
5108	208	WerFault.exe	247
4848	3952	WerFault.exe	252
3052	3952	WerFault.exe	252
1884	4560	WerFault.exe	257
4660	4560	WerFault.exe	257

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	In allegato il nuovo elenco ordini.exe

Suspicious behavior: MapViewOfSection 31 IoCs

pid	Process
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe
4048	java1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4048	java1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 2348 wrote to memory of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 2348 wrote to memory of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 2348 wrote to memory of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 2348 wrote to memory of 4484	2348	In allegato il nuovo elenco ordini.exe	91
PID 4484 wrote to memory of 1644	4484	In allegato il nuovo elenco ordini.exe	92
PID 4484 wrote to memory of 1644	4484	In allegato il nuovo elenco ordini.exe	92
PID 4484 wrote to memory of 1644	4484	In allegato il nuovo elenco ordini.exe	92
PID 1644 wrote to memory of 2396	1644	WScript.exe	93
PID 1644 wrote to memory of 2396	1644	WScript.exe	93
PID 1644 wrote to memory of 2396	1644	WScript.exe	93
PID 2396 wrote to memory of 784	2396	cmd.exe	95
PID 2396 wrote to memory of 784	2396	cmd.exe	95
PID 2396 wrote to memory of 784	2396	cmd.exe	95
PID 4048 wrote to memory of 1764	4048	java1.exe	105
PID 4048 wrote to memory of 1764	4048	java1.exe	105
PID 4048 wrote to memory of 1764	4048	java1.exe	105
PID 4048 wrote to memory of 1764	4048	java1.exe	105
PID 4048 wrote to memory of 1948	4048	java1.exe	111
PID 4048 wrote to memory of 1948	4048	java1.exe	111
PID 4048 wrote to memory of 1948	4048	java1.exe	111
PID 4048 wrote to memory of 1948	4048	java1.exe	111
PID 4048 wrote to memory of 1856	4048	java1.exe	116
PID 4048 wrote to memory of 1856	4048	java1.exe	116
PID 4048 wrote to memory of 1856	4048	java1.exe	116
PID 4048 wrote to memory of 1856	4048	java1.exe	116
PID 4048 wrote to memory of 4952	4048	java1.exe	121
PID 4048 wrote to memory of 4952	4048	java1.exe	121
PID 4048 wrote to memory of 4952	4048	java1.exe	121
PID 4048 wrote to memory of 4952	4048	java1.exe	121
PID 4048 wrote to memory of 1736	4048	java1.exe	126
PID 4048 wrote to memory of 1736	4048	java1.exe	126
PID 4048 wrote to memory of 1736	4048	java1.exe	126
PID 4048 wrote to memory of 1736	4048	java1.exe	126
PID 4048 wrote to memory of 1956	4048	java1.exe	131
PID 4048 wrote to memory of 1956	4048	java1.exe	131
PID 4048 wrote to memory of 1956	4048	java1.exe	131
PID 4048 wrote to memory of 1956	4048	java1.exe	131
PID 4048 wrote to memory of 2460	4048	java1.exe	136
PID 4048 wrote to memory of 2460	4048	java1.exe	136
PID 4048 wrote to memory of 2460	4048	java1.exe	136
PID 4048 wrote to memory of 2460	4048	java1.exe	136
PID 4048 wrote to memory of 4360	4048	java1.exe	141
PID 4048 wrote to memory of 4360	4048	java1.exe	141
PID 4048 wrote to memory of 4360	4048	java1.exe	141
PID 4048 wrote to memory of 4360	4048	java1.exe	141
PID 4048 wrote to memory of 1476	4048	java1.exe	146
PID 4048 wrote to memory of 1476	4048	java1.exe	146
PID 4048 wrote to memory of 1476	4048	java1.exe	146
PID 4048 wrote to memory of 1476	4048	java1.exe	146
PID 4048 wrote to memory of 1092	4048	java1.exe	152
PID 4048 wrote to memory of 1092	4048	java1.exe	152
PID 4048 wrote to memory of 1092	4048	java1.exe	152
PID 4048 wrote to memory of 1092	4048	java1.exe	152
PID 4048 wrote to memory of 4756	4048	java1.exe	157
PID 4048 wrote to memory of 4756	4048	java1.exe	157
PID 4048 wrote to memory of 4756	4048	java1.exe	157
PID 4048 wrote to memory of 4756	4048	java1.exe	157
PID 4048 wrote to memory of 636	4048	java1.exe	162
PID 4048 wrote to memory of 636	4048	java1.exe	162
PID 4048 wrote to memory of 636	4048	java1.exe	162
PID 4048 wrote to memory of 636	4048	java1.exe	162
PID 4048 wrote to memory of 3304	4048	java1.exe	167
PID 4048 wrote to memory of 3304	4048	java1.exe	167

C:\Users\Admin\AppData\Local\Temp\In allegato il nuovo elenco ordini.exe
"C:\Users\Admin\AppData\Local\Temp\In allegato il nuovo elenco ordini.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\In allegato il nuovo elenco ordini.exe
  "C:\Users\Admin\AppData\Local\Temp\In allegato il nuovo elenco ordini.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\java1\java1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\java1\java1.exe
        
        C:\java1\java1.exe
        5⤵
        Executes dropped EXE
        
        PID:784
      - C:\java1\java1.exe
        
        "C:\java1\java1.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 756
        8⤵
        Program crash
        
        PID:948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 772
        8⤵
        Program crash
        
        PID:2192
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 644
        8⤵
        Program crash
        
        PID:4652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 648
        8⤵
        Program crash
        
        PID:1388
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 680
        8⤵
        Program crash
        
        PID:4996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 664
        8⤵
        Program crash
        
        PID:4388
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 648
        8⤵
        Program crash
        
        PID:1164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 740
        8⤵
        Program crash
        
        PID:2112
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 668
        8⤵
        Program crash
        
        PID:4644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 688
        8⤵
        Program crash
        
        PID:4796
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 648
        8⤵
        Program crash
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 776
        8⤵
        Program crash
        
        PID:1440
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 668
        8⤵
        Program crash
        
        PID:444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 788
        8⤵
        Program crash
        
        PID:5064
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 648
        8⤵
        Program crash
        
        PID:4856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 668
        8⤵
        Program crash
        
        PID:3140
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 664
        8⤵
        Program crash
        
        PID:4376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 784
        8⤵
        Program crash
        
        PID:2976
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 648
        8⤵
        Program crash
        
        PID:3644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 668
        8⤵
        Program crash
        
        PID:484
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 656
        8⤵
        Program crash
        
        PID:2996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 660
        8⤵
        Program crash
        
        PID:540
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 652
        8⤵
        Program crash
        
        PID:2716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 664
        8⤵
        Program crash
        
        PID:4496
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 648
        8⤵
        Program crash
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 760
        8⤵
        Program crash
        
        PID:812
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 656
        8⤵
        Program crash
        
        PID:2116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 664
        8⤵
        Program crash
        
        PID:4244
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 648
        8⤵
        Program crash
        
        PID:1488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 716
        8⤵
        Program crash
        
        PID:432
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 728
        8⤵
        Program crash
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 768
        8⤵
        Program crash
        
        PID:752
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 648
        8⤵
        Program crash
        
        PID:2268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 668
        8⤵
        Program crash
        
        PID:2456
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 656
        8⤵
        Program crash
        
        PID:5100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 776
        8⤵
        Program crash
        
        PID:4720
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 648
        8⤵
        Program crash
        
        PID:2332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 760
        8⤵
        Program crash
        
        PID:1468
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 648
        8⤵
        Program crash
        
        PID:4544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 740
        8⤵
        Program crash
        
        PID:3772
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 656
        8⤵
        Program crash
        
        PID:2588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 776
        8⤵
        Program crash
        
        PID:2316
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 656
        8⤵
        Program crash
        
        PID:4968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 788
        8⤵
        Program crash
        
        PID:3028
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 776
        8⤵
        Program crash
        
        PID:4740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 796
        8⤵
        Program crash
        
        PID:4416
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 668
        8⤵
        Program crash
        
        PID:2784
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 772
        8⤵
        Program crash
        
        PID:812
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 668
        8⤵
        Program crash
        
        PID:3556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 784
        8⤵
        Program crash
        
        PID:1944
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 648
        8⤵
        Program crash
        
        PID:2428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 804
        8⤵
        Program crash
        
        PID:4340
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:8
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 656
        8⤵
        Program crash
        
        PID:4280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 716
        8⤵
        Program crash
        
        PID:4408
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 768
        8⤵
        Program crash
        
        PID:2476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 664
        8⤵
        Program crash
        
        PID:444
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 648
        8⤵
        Program crash
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 776
        8⤵
        Program crash
        
        PID:5108
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 664
        8⤵
        Program crash
        
        PID:4848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 588
        8⤵
        Program crash
        
        PID:3052
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        7⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 648
        8⤵
        Program crash
        
        PID:1884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 804
        8⤵
        Program crash
        
        PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1764 -ip 1764
1⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1764 -ip 1764
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1948 -ip 1948
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1948 -ip 1948
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1856 -ip 1856
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1856 -ip 1856
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4952 -ip 4952
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4952 -ip 4952
1⤵
PID:808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1736 -ip 1736
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1736 -ip 1736
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1956 -ip 1956
1⤵
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1956 -ip 1956
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2460 -ip 2460
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2460 -ip 2460
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4360 -ip 4360
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4360 -ip 4360
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1476 -ip 1476
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1476 -ip 1476
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1092 -ip 1092
1⤵
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1092 -ip 1092
1⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4756 -ip 4756
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4756 -ip 4756
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 636 -ip 636
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 636 -ip 636
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3304 -ip 3304
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3304 -ip 3304
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3548 -ip 3548
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 3548 -ip 3548
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2408 -ip 2408
1⤵
PID:756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2408 -ip 2408
1⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3912 -ip 3912
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3912 -ip 3912
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4368 -ip 4368
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4368 -ip 4368
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2072 -ip 2072
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2072 -ip 2072
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3780 -ip 3780
1⤵
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3780 -ip 3780
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1740 -ip 1740
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1740 -ip 1740
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4292 -ip 4292
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4292 -ip 4292
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3660 -ip 3660
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3660 -ip 3660
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 3112 -ip 3112
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3112 -ip 3112
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3060 -ip 3060
1⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3060 -ip 3060
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4092 -ip 4092
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 4092 -ip 4092
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 756 -ip 756
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 756 -ip 756
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 8 -ip 8
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 8 -ip 8
1⤵
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4772 -ip 4772
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4772 -ip 4772
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 208 -ip 208
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 208 -ip 208
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 3952 -ip 3952
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 3952 -ip 3952
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 4560 -ip 4560
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4560 -ip 4560
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
538B

MD5
2353bce32f2af287e75f20a2f2d160be

SHA1
2c93ea6afa73cb0f26545fbd169b03afeffabfb9

SHA256
8a2a0edbe125c36a4d47359fc5b66661c96abcc7590b57825b3afc0afd674909

SHA512
33181cd1744818cfce37dd0340d853fece25380a0936e4d0af7ecdef5a4cff1441daef0956608d66d3e895c1d9abb3a3120cf4f294a5f2bd7b4907286f1c7b01

Download Submit
C:\java1\java1.exe

Filesize
967KB

MD5
af23007b78a02d5d5ad429880a505c9c

SHA1
fe82317e4682b0d23b457f26c2a3f6493e37a530

SHA256
1fc078aab853bc4972b2e74e1f04879cd246668bdf120d210fd51a029c021c1c

SHA512
849bdfc8e433cf07d75555895dc9eb6f766dc21f15e8d784a04e976723d05b8bb041e833553feb2e1f869ef9018dc489eb8e7e9d9d3d1929bea65d903c3db1a7

Download Submit
C:\java1\java1.exe

Filesize
967KB

MD5
af23007b78a02d5d5ad429880a505c9c

SHA1
fe82317e4682b0d23b457f26c2a3f6493e37a530

SHA256
1fc078aab853bc4972b2e74e1f04879cd246668bdf120d210fd51a029c021c1c

SHA512
849bdfc8e433cf07d75555895dc9eb6f766dc21f15e8d784a04e976723d05b8bb041e833553feb2e1f869ef9018dc489eb8e7e9d9d3d1929bea65d903c3db1a7

Download Submit
C:\java1\java1.exe

Filesize
967KB

MD5
af23007b78a02d5d5ad429880a505c9c

SHA1
fe82317e4682b0d23b457f26c2a3f6493e37a530

SHA256
1fc078aab853bc4972b2e74e1f04879cd246668bdf120d210fd51a029c021c1c

SHA512
849bdfc8e433cf07d75555895dc9eb6f766dc21f15e8d784a04e976723d05b8bb041e833553feb2e1f869ef9018dc489eb8e7e9d9d3d1929bea65d903c3db1a7

Download Submit
memory/8-358-0x0000000000F00000-0x0000000000FFB000-memory.dmp

Filesize
1004KB

Download
memory/208-362-0x0000000000E00000-0x0000000000EFB000-memory.dmp

Filesize
1004KB

Download
memory/636-326-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/636-325-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/756-356-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/1092-321-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/1476-319-0x00000000006F0000-0x00000000007EB000-memory.dmp

Filesize
1004KB

Download
memory/1736-310-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/1740-343-0x0000000001230000-0x000000000132B000-memory.dmp

Filesize
1004KB

Download
memory/1764-302-0x0000000000800000-0x00000000008FB000-memory.dmp

Filesize
1004KB

Download
memory/1856-306-0x0000000000600000-0x00000000006FB000-memory.dmp

Filesize
1004KB

Download
memory/1948-304-0x0000000001210000-0x000000000130B000-memory.dmp

Filesize
1004KB

Download
memory/1956-313-0x0000000000EB0000-0x0000000000FAB000-memory.dmp

Filesize
1004KB

Download
memory/2072-339-0x0000000000800000-0x00000000008FB000-memory.dmp

Filesize
1004KB

Download
memory/2348-167-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-150-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-132-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-168-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-169-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-170-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-171-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-172-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-173-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-174-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-175-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-176-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-177-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-178-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-179-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-180-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-181-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-182-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-183-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-184-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-185-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-186-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-187-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-188-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-190-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-189-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-191-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-192-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-193-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-194-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-195-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-134-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-133-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-165-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-135-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-164-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-136-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-163-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-161-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-162-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-160-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-159-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-138-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-156-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-158-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-157-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-152-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-155-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-137-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-139-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-154-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-153-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-141-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-151-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-166-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-140-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-142-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-143-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-144-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-149-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-148-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-147-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-146-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2348-145-0x00000000024C0000-0x0000000002521000-memory.dmp

Filesize
388KB

Download
memory/2408-333-0x0000000001290000-0x000000000138B000-memory.dmp

Filesize
1004KB

Download
memory/2460-315-0x0000000000840000-0x000000000093B000-memory.dmp

Filesize
1004KB

Download
memory/3060-352-0x00000000012E0000-0x00000000013DB000-memory.dmp

Filesize
1004KB

Download
memory/3112-349-0x0000000000AA0000-0x0000000000B9B000-memory.dmp

Filesize
1004KB

Download
memory/3112-350-0x0000000000AA0000-0x0000000000B9B000-memory.dmp

Filesize
1004KB

Download
memory/3304-328-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/3304-329-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/3548-331-0x0000000001010000-0x000000000110B000-memory.dmp

Filesize
1004KB

Download
memory/3660-347-0x00000000012E0000-0x00000000013DB000-memory.dmp

Filesize
1004KB

Download
memory/3780-341-0x0000000001290000-0x000000000138B000-memory.dmp

Filesize
1004KB

Download
memory/3912-335-0x0000000001270000-0x000000000136B000-memory.dmp

Filesize
1004KB

Download
memory/3952-364-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/4048-301-0x0000000000400000-0x000000000047F095-memory.dmp

Filesize
508KB

Download
memory/4048-311-0x0000000000400000-0x000000000047F095-memory.dmp

Filesize
508KB

Download
memory/4092-354-0x0000000000400000-0x00000000004FB000-memory.dmp

Filesize
1004KB

Download
memory/4292-345-0x0000000000E10000-0x0000000000F0B000-memory.dmp

Filesize
1004KB

Download
memory/4360-317-0x00000000008A0000-0x000000000099B000-memory.dmp

Filesize
1004KB

Download
memory/4368-337-0x0000000000840000-0x000000000093B000-memory.dmp

Filesize
1004KB

Download
memory/4484-277-0x0000000000400000-0x000000000047F095-memory.dmp

Filesize
508KB

Download
memory/4484-243-0x0000000000400000-0x000000000047F095-memory.dmp

Filesize
508KB

Download
memory/4560-366-0x0000000000A80000-0x0000000000B7B000-memory.dmp

Filesize
1004KB

Download
memory/4756-323-0x00000000012F0000-0x00000000013EB000-memory.dmp

Filesize
1004KB

Download
memory/4772-360-0x0000000000430000-0x000000000052B000-memory.dmp

Filesize
1004KB

Download
memory/4952-308-0x0000000000910000-0x0000000000A0B000-memory.dmp

Filesize
1004KB

Download