glupteba | 43e1b48cfd1b549a06df210000ef97f350e6dad5a12a053157420f9a5aaa906e

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Size

3.9MB
MD5

7a109519d3c1fb1e89abfd33dd9ac1cf
SHA1

80c8b0de3d6baa8a8992d336d570b110835d0f75
SHA256

43e1b48cfd1b549a06df210000ef97f350e6dad5a12a053157420f9a5aaa906e
SHA512

85e0e974d189ddefca695ddc040386a8426f4919fa5832bdb9c323a32b467685dcf26a6666b97719eb6e4feeb9ca708bb0c44bf1f18a432d0a6d221293de4f47
SSDEEP

98304:eE1gv+P9a92U2FvyxtPjPxVNUNCU42/zBkWTwFJL2XBV9:7gtEU2FvaRP3W34cuJSX

Score

10^/10

glupteba dropper evasion loader persistence

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1600-2-0x0000000001150000-0x000000000183F000-memory.dmp	family_glupteba
behavioral2/memory/1600-3-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/1600-4-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/1600-5-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/1600-6-0x0000000001150000-0x000000000183F000-memory.dmp	family_glupteba
behavioral2/memory/4092-9-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4092-15-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-17-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-18-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-19-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-20-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-21-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-22-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-25-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-27-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba
behavioral2/memory/4688-28-0x0000000000400000-0x0000000000B0A000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

4756 netsh.exe
4720 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

4688 csrss.exe

pid	process
4756	netsh.exe
4720	netsh.exe

pid	process
4688	csrss.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SnowyFeather = "\"C:\\Windows\\rss\\csrss.exe\""	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\rss	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
File created	C:\Windows\rss\csrss.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1636	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3364	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3060	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4004	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4460	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3840	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1916	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
2356	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4952	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4868	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4756	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3940	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4920	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
800	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4720	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3720	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3752	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3312	1600	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4108	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
2000	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4824	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1216	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4988	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
2128	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
232	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
3132	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1712	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4612	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4360	4092	WerFault.exe	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
2672	4688	WerFault.exe	csrss.exe
1488	4688	WerFault.exe	csrss.exe
3368	4688	WerFault.exe	csrss.exe
4332	4688	WerFault.exe	csrss.exe
2800	4688	WerFault.exe	csrss.exe
4404	4688	WerFault.exe	csrss.exe
1004	4688	WerFault.exe	csrss.exe
324	4688	WerFault.exe	csrss.exe
388	4688	WerFault.exe	csrss.exe
2428	4688	WerFault.exe	csrss.exe
4628	4688	WerFault.exe	csrss.exe
448	4688	WerFault.exe	csrss.exe
1588	4688	WerFault.exe	csrss.exe
1968	4688	WerFault.exe	csrss.exe
1656	4688	WerFault.exe	csrss.exe
4960	4688	WerFault.exe	csrss.exe
464	4688	WerFault.exe	csrss.exe
4676	4688	WerFault.exe	csrss.exe
1380	4688	WerFault.exe	csrss.exe
3836	4688	WerFault.exe	csrss.exe
2184	4688	WerFault.exe	csrss.exe
5024	4688	WerFault.exe	csrss.exe
2520	4688	WerFault.exe	csrss.exe
5088	4688	WerFault.exe	csrss.exe
2788	4688	WerFault.exe	csrss.exe
2128	4688	WerFault.exe	csrss.exe
2204	4688	WerFault.exe	csrss.exe
1324	4688	WerFault.exe	csrss.exe
3056	4688	WerFault.exe	csrss.exe
3832	4688	WerFault.exe	csrss.exe
4748	4688	WerFault.exe	csrss.exe
2608	4688	WerFault.exe	csrss.exe
3580	4688	WerFault.exe	csrss.exe
4996	4688	WerFault.exe	csrss.exe
1536	4688	WerFault.exe	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.execsrss.exe

pid	process
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
4688	csrss.exe
4688	csrss.exe
4688	csrss.exe
4688	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1600	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.execmd.execmd.exe

description	pid	process	target process
PID 4092 wrote to memory of 3680	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	cmd.exe
PID 4092 wrote to memory of 3680	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	cmd.exe
PID 3680 wrote to memory of 4756	3680	cmd.exe	netsh.exe
PID 3680 wrote to memory of 4756	3680	cmd.exe	netsh.exe
PID 4092 wrote to memory of 4232	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	cmd.exe
PID 4092 wrote to memory of 4232	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	cmd.exe
PID 4232 wrote to memory of 4720	4232	cmd.exe	netsh.exe
PID 4232 wrote to memory of 4720	4232	cmd.exe	netsh.exe
PID 4092 wrote to memory of 4688	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	csrss.exe
PID 4092 wrote to memory of 4688	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	csrss.exe
PID 4092 wrote to memory of 4688	4092	7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 328
  2⤵
  - Program crash
  PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 352
  2⤵
  - Program crash
  PID:3364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 360
  2⤵
  - Program crash
  PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 600
  2⤵
  - Program crash
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 708
  2⤵
  - Program crash
  PID:4460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 732
  2⤵
  - Program crash
  PID:3840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 732
  2⤵
  - Program crash
  PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 724
  2⤵
  - Program crash
  PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 756
  2⤵
  - Program crash
  PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 748
  2⤵
  - Program crash
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 684
  2⤵
  - Program crash
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 708
  2⤵
  - Program crash
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 744
  2⤵
  - Program crash
  PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 852
  2⤵
  - Program crash
  PID:800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 836
  2⤵
  - Program crash
  PID:4720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 880
  2⤵
  - Program crash
  PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 724
  2⤵
  - Program crash
  PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 752
  2⤵
  - Program crash
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7a109519d3c1fb1e89abfd33dd9ac1cf_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 292
    3⤵
    - Program crash
    PID:4108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 296
    3⤵
    - Program crash
    PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 296
    3⤵
    - Program crash
    PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 484
    3⤵
    - Program crash
    PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 508
    3⤵
    - Program crash
    PID:4988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 700
    3⤵
    - Program crash
    PID:2128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 792
    3⤵
    - Program crash
    PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 808
    3⤵
    - Program crash
    PID:3132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 808
    3⤵
    - Program crash
    PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 832
    3⤵
    - Program crash
    PID:4612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 836
    3⤵
    - Program crash
    PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4756
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4720
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 328
      4⤵
      Program crash
      PID:2672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 332
      4⤵
      Program crash
      PID:1488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 352
      4⤵
      Program crash
      PID:3368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 544
      4⤵
      Program crash
      PID:4332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 780
      4⤵
      Program crash
      PID:2800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 780
      4⤵
      Program crash
      PID:4404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 780
      4⤵
      Program crash
      PID:1004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 864
      4⤵
      Program crash
      PID:324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 872
      4⤵
      Program crash
      PID:388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 884
      4⤵
      Program crash
      PID:2428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1012
      4⤵
      Program crash
      PID:4628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 984
      4⤵
      Program crash
      PID:448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 928
      4⤵
      Program crash
      PID:1588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 720
      4⤵
      Program crash
      PID:1968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 832
      4⤵
      Program crash
      PID:1656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 984
      4⤵
      Program crash
      PID:4960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 852
      4⤵
      Program crash
      PID:464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1000
      4⤵
      Program crash
      PID:4676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 932
      4⤵
      Program crash
      PID:1380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 820
      4⤵
      Program crash
      PID:3836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 856
      4⤵
      Program crash
      PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 764
      4⤵
      Program crash
      PID:5024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 976
      4⤵
      Program crash
      PID:2520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 876
      4⤵
      Program crash
      PID:5088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 764
      4⤵
      Program crash
      PID:2788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 876
      4⤵
      Program crash
      PID:2128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1036
      4⤵
      Program crash
      PID:2204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 876
      4⤵
      Program crash
      PID:1324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1076
      4⤵
      Program crash
      PID:3056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 892
      4⤵
      Program crash
      PID:3832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 996
      4⤵
      Program crash
      PID:4748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 852
      4⤵
      Program crash
      PID:2608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1004
      4⤵
      Program crash
      PID:3580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1072
      4⤵
      Program crash
      PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 980
      4⤵
      Program crash
      PID:1536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1060
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1068
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 900
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1072
      4⤵
      PID:2336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1080
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1088
      4⤵
      PID:4324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 712
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1104
      4⤵
      PID:3844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1064
      4⤵
      PID:4508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 952
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1044
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 892
      4⤵
      PID:1688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1044
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1040
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1092
      4⤵
      PID:4920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 928
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 936
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1036
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1028
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1016
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1068
      4⤵
      PID:464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 972
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 852
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1036
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1072
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1076
      4⤵
      PID:4184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1080
      4⤵
      PID:4084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 936
      4⤵
      PID:2520
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 980
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 712
      4⤵
      PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 832
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 896
      4⤵
      PID:728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 980
      4⤵
      PID:3872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1068
      4⤵
      PID:3832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1088
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1080
      4⤵
      PID:4944
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1060
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1080
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 900
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1052
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 764
      4⤵
      PID:3796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 924
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 980
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1068
      4⤵
      PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1104
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 712
      4⤵
      PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1600 -ip 1600
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1600 -ip 1600
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1600 -ip 1600
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1600 -ip 1600
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1600 -ip 1600
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1600 -ip 1600
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1600 -ip 1600
1⤵
PID:912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1600 -ip 1600
1⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1600 -ip 1600
1⤵
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1600 -ip 1600
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1600 -ip 1600
1⤵
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1600 -ip 1600
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 1600 -ip 1600
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1600 -ip 1600
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1600 -ip 1600
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1600 -ip 1600
1⤵
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1600 -ip 1600
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 1600 -ip 1600
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4092 -ip 4092
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4092 -ip 4092
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4092 -ip 4092
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4092 -ip 4092
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4092 -ip 4092
1⤵
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4092 -ip 4092
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4092 -ip 4092
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4092 -ip 4092
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4092 -ip 4092
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4092 -ip 4092
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4092 -ip 4092
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 4688
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 4688
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4688 -ip 4688
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4688 -ip 4688
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4688 -ip 4688
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4688 -ip 4688
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4688 -ip 4688
1⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4688 -ip 4688
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4688 -ip 4688
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4688 -ip 4688
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 4688
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 4688
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4688 -ip 4688
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4688 -ip 4688
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4688 -ip 4688
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 4688
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4688 -ip 4688
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4688 -ip 4688
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4688 -ip 4688
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4688 -ip 4688
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 4688
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4688 -ip 4688
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4688 -ip 4688
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4688 -ip 4688
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 4688
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4688 -ip 4688
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4688 -ip 4688
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4688 -ip 4688
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4688 -ip 4688
1⤵
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4688 -ip 4688
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4688 -ip 4688
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4688 -ip 4688
1⤵
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4688 -ip 4688
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4688 -ip 4688
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4688 -ip 4688
1⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4688 -ip 4688
1⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4688 -ip 4688
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 4688 -ip 4688
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4688 -ip 4688
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4688 -ip 4688
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4688 -ip 4688
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4688 -ip 4688
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\rss\csrss.exe

Filesize
3.9MB

MD5
7a109519d3c1fb1e89abfd33dd9ac1cf

SHA1
80c8b0de3d6baa8a8992d336d570b110835d0f75

SHA256
43e1b48cfd1b549a06df210000ef97f350e6dad5a12a053157420f9a5aaa906e

SHA512
85e0e974d189ddefca695ddc040386a8426f4919fa5832bdb9c323a32b467685dcf26a6666b97719eb6e4feeb9ca708bb0c44bf1f18a432d0a6d221293de4f47

Download Submit
memory/1600-5-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/1600-2-0x0000000001150000-0x000000000183F000-memory.dmp

Filesize
6.9MB

Download
memory/1600-1-0x0000000000DA0000-0x0000000001147000-memory.dmp

Filesize
3.7MB

Download
memory/1600-4-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/1600-6-0x0000000001150000-0x000000000183F000-memory.dmp

Filesize
6.9MB

Download
memory/1600-3-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4092-8-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4092-9-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4092-15-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-28-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-18-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-17-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-19-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-20-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-21-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-22-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-25-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download
memory/4688-27-0x0000000000400000-0x0000000000B0A000-memory.dmp

Filesize
7.0MB

Download