bitrat | 6248ca77e095fba357308535038777b0e555c085dfa828a6f16faac4d818a7a3

General

Target

f16151d0d1ea959552d2fe8a724b0dc5.exe
Size

5.0MB
MD5

f16151d0d1ea959552d2fe8a724b0dc5
SHA1

d71382495ec36153ce86cb0e94755d283fbe53e6
SHA256

6248ca77e095fba357308535038777b0e555c085dfa828a6f16faac4d818a7a3
SHA512

3f9b550ed515a5e0f3f99f2235bef39d1a8332496b1e37cdf107c1ab4d54875c8a6142d3a5c277c504328b04821cd8d46608e0c2c977a4c256e1530f20096e57
SSDEEP

98304:viS/sRZddY2EGcHg/InwJtNELakTwPAALRuPa6o0h7:vxkZdCvGwbaYTas5o09

Score

10^/10

bitrat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

elevenpaths.cc:420

Attributes

communication_password
e48e13207341b6bffb7fb1622282247b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

f16151d0d1ea959552d2fe8a724b0dc5.exe

pid	process
2920	f16151d0d1ea959552d2fe8a724b0dc5.exe
2920	f16151d0d1ea959552d2fe8a724b0dc5.exe
2920	f16151d0d1ea959552d2fe8a724b0dc5.exe
2920	f16151d0d1ea959552d2fe8a724b0dc5.exe

Program crash 52 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2440	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2484	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4052	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4468	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4680	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
5008	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3764	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
396	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1800	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1288	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4420	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4912	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1980	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2484	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2624	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
748	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4648	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1704	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1388	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3280	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3884	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
224	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3612	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
848	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2948	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3496	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1544	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4640	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
856	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1540	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2264	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4680	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1452	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
524	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4296	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4960	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1620	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2944	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2856	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2724	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
5000	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1540	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2264	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1544	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4540	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
856	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3720	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3880	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
4588	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
1912	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
2944	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe
3480	2920	WerFault.exe	f16151d0d1ea959552d2fe8a724b0dc5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f16151d0d1ea959552d2fe8a724b0dc5.exe

description pid process

Token: SeShutdownPrivilege 2920 f16151d0d1ea959552d2fe8a724b0dc5.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f16151d0d1ea959552d2fe8a724b0dc5.exe

pid process

2920 f16151d0d1ea959552d2fe8a724b0dc5.exe
2920 f16151d0d1ea959552d2fe8a724b0dc5.exe

description	pid	process
Token: SeShutdownPrivilege	2920	f16151d0d1ea959552d2fe8a724b0dc5.exe

C:\Users\Admin\AppData\Local\Temp\f16151d0d1ea959552d2fe8a724b0dc5.exe
"C:\Users\Admin\AppData\Local\Temp\f16151d0d1ea959552d2fe8a724b0dc5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 876
2⤵
- Program crash
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 964
2⤵
- Program crash
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1004
2⤵
- Program crash
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 696
2⤵
- Program crash
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1260
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1320
2⤵
- Program crash
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1260
2⤵
- Program crash
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1304
2⤵
- Program crash
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1312
2⤵
- Program crash
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1356
2⤵
- Program crash
PID:1288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1380
2⤵
- Program crash
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1392
2⤵
- Program crash
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1356
2⤵
- Program crash
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1432
2⤵
- Program crash
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1336
2⤵
- Program crash
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1284
2⤵
- Program crash
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1416
2⤵
- Program crash
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1444
2⤵
- Program crash
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1424
2⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1308
2⤵
- Program crash
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1264
2⤵
- Program crash
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1444
2⤵
- Program crash
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1472
2⤵
- Program crash
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1484
2⤵
- Program crash
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1496
2⤵
- Program crash
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1524
2⤵
- Program crash
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1468
2⤵
- Program crash
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1420
2⤵
- Program crash
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1444
2⤵
- Program crash
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1456
2⤵
- Program crash
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1452
2⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1288
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1356
2⤵
- Program crash
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1364
2⤵
- Program crash
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1392
2⤵
- Program crash
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1460
2⤵
- Program crash
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1288
2⤵
- Program crash
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1348
2⤵
- Program crash
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1344
2⤵
- Program crash
PID:2856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1448
2⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1276
2⤵
- Program crash
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1476
2⤵
- Program crash
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1444
2⤵
- Program crash
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1284
2⤵
- Program crash
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1452
2⤵
- Program crash
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1408
2⤵
- Program crash
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1432
2⤵
- Program crash
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1476
2⤵
- Program crash
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1508
2⤵
- Program crash
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1420
2⤵
- Program crash
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1300
2⤵
- Program crash
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1412
2⤵
- Program crash
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2920 -ip 2920
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2920 -ip 2920
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2920 -ip 2920
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2920 -ip 2920
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2920 -ip 2920
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2920 -ip 2920
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2920 -ip 2920
1⤵
PID:2652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2920 -ip 2920
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2920 -ip 2920
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2920 -ip 2920
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2920 -ip 2920
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2920 -ip 2920
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2920 -ip 2920
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2920 -ip 2920
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2920 -ip 2920
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2920 -ip 2920
1⤵
PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2920 -ip 2920
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2920 -ip 2920
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2920 -ip 2920
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2920 -ip 2920
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2920 -ip 2920
1⤵
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2920 -ip 2920
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2920 -ip 2920
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2920 -ip 2920
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2920 -ip 2920
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2920 -ip 2920
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2920 -ip 2920
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2920 -ip 2920
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2920 -ip 2920
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2920 -ip 2920
1⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2920 -ip 2920
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2920 -ip 2920
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2920 -ip 2920
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2920 -ip 2920
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2920 -ip 2920
1⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2920 -ip 2920
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2920 -ip 2920
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2920 -ip 2920
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2920 -ip 2920
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2920 -ip 2920
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2920 -ip 2920
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2920 -ip 2920
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2920 -ip 2920
1⤵
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2920 -ip 2920
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2920 -ip 2920
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2920 -ip 2920
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2920 -ip 2920
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2920 -ip 2920
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2920 -ip 2920
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2920 -ip 2920
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2920 -ip 2920
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2920 -ip 2920
1⤵
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2920-0-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2920-2-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-1-0x0000000003180000-0x0000000003629000-memory.dmp

Filesize
4.7MB

Download
memory/2920-3-0x0000000074D40000-0x0000000074D79000-memory.dmp

Filesize
228KB

Download
memory/2920-4-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-5-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-6-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-7-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-8-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-9-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-11-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-12-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-13-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-14-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-16-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-17-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-24-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-18-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-26-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-27-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-29-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-30-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download
memory/2920-31-0x0000000074A90000-0x0000000074AC9000-memory.dmp

Filesize
228KB

Download
memory/2920-32-0x0000000000400000-0x000000000090E000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing