gh0strat | cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
Size 4.9MB
Sample240613-cebd9atfqp
SHA256 cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7
MD5 40b338eac24f2202caba66cdca062409
SHA1 800a68f90767a5817198e593cd2d63ef1027804a
SHA512 e91306155a77d0769272ca4590f554e9115e9b4984b6d4e61358d0e06de83e1beb3371fe4074b7d7e1314354cdfc9932806b0288b2fbd5389994732fc96879f2
SSDEEP 98304:dvWCp59KLkKKQDhd9X8zfq+qM3p+Ok+28MhCyGrtbHzdl3OktT:hWCpQLH7OzC+xp+vG7ykbHhl+ktT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat upx

Malware Config

Signatures

Gh0st RAT payload 10 IoCs

resource	yara_rule
behavioral2/memory/1480-114-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1480-113-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1480-109-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/1480-108-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4820-146-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4820-147-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/3752-173-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/3752-174-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4744-189-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat
behavioral2/memory/4744-190-0x0000000010000000-0x000000001018F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/1480-114-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/1480-113-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/1480-109-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/1480-108-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/1480-106-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/4820-146-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/4820-147-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/4820-148-0x0000000000400000-0x000000000044D000-memory.dmp	UPX
behavioral2/memory/3752-173-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/3752-174-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/4744-189-0x0000000010000000-0x000000001018F000-memory.dmp	UPX
behavioral2/memory/4744-190-0x0000000010000000-0x000000001018F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	winos.exe

Executes dropped EXE 64 IoCs

pid	Process
2952	ttttt.exe
3468	winos.exe
2956	Client.exe
5012	Client.exe
3080	EP.exe
1508	Client.exe
1480	EP.exe
3020	Client.exe
4960	Client.exe
2372	Client.exe
4304	EP.exe
64	Client.exe
4820	EP.exe
1376	Client.exe
4264	Client.exe
1704	Client.exe
4496	EP.exe
2448	Client.exe
3752	EP.exe
2104	Client.exe
4516	Client.exe
3512	Client.exe
4980	EP.exe
3204	Client.exe
4744	EP.exe
2512	Client.exe
2328	Client.exe
2748	Client.exe
2704	EP.exe
1960	Client.exe
4316	EP.exe
3956	Client.exe
1184	Client.exe
2724	Client.exe
3364	EP.exe
3328	Client.exe
1112	EP.exe
5080	Client.exe
4060	Client.exe
832	Client.exe
1412	EP.exe
4104	Client.exe
4884	EP.exe
3612	Client.exe
1968	Client.exe
756	Client.exe
4504	EP.exe
3792	Client.exe
1512	EP.exe
4780	Client.exe
5060	Client.exe
4952	Client.exe
4876	EP.exe
1748	Client.exe
2912	EP.exe
1948	Client.exe
4932	Client.exe
2300	Client.exe
2216	EP.exe
3908	Client.exe
2028	EP.exe
4644	Client.exe
1156	Client.exe
4888	Client.exe

Loads dropped DLL 64 IoCs

pid	Process
2952	ttttt.exe
2952	ttttt.exe
3468	winos.exe
2956	Client.exe
5012	Client.exe
3080	EP.exe
1508	Client.exe
3080	EP.exe
3080	EP.exe
3080	EP.exe
3080	EP.exe
3080	EP.exe
3080	EP.exe
3020	Client.exe
4960	Client.exe
2372	Client.exe
4304	EP.exe
4304	EP.exe
4304	EP.exe
4304	EP.exe
64	Client.exe
1376	Client.exe
4264	Client.exe
1704	Client.exe
4496	EP.exe
4496	EP.exe
4496	EP.exe
4496	EP.exe
2448	Client.exe
2104	Client.exe
4516	Client.exe
3512	Client.exe
4980	EP.exe
4980	EP.exe
4980	EP.exe
4980	EP.exe
3204	Client.exe
2512	Client.exe
2328	Client.exe
2748	Client.exe
2704	EP.exe
2704	EP.exe
2704	EP.exe
2704	EP.exe
1960	Client.exe
3956	Client.exe
1184	Client.exe
2724	Client.exe
3364	EP.exe
3364	EP.exe
3364	EP.exe
3364	EP.exe
3328	Client.exe
5080	Client.exe
4060	Client.exe
832	Client.exe
1412	EP.exe
1412	EP.exe
1412	EP.exe
1412	EP.exe
4104	Client.exe
3612	Client.exe
1968	Client.exe
756	Client.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1480-114-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1480-113-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1480-109-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1480-108-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/1480-106-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4820-146-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4820-147-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/3752-173-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/3752-174-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4744-189-0x0000000010000000-0x000000001018F000-memory.dmp	upx
behavioral2/memory/4744-190-0x0000000010000000-0x000000001018F000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	EP.exe
File opened (read-only)	\??\Q:	EP.exe
File opened (read-only)	\??\U:	EP.exe
File opened (read-only)	\??\W:	EP.exe
File opened (read-only)	\??\H:	EP.exe
File opened (read-only)	\??\L:	EP.exe
File opened (read-only)	\??\N:	EP.exe
File opened (read-only)	\??\Y:	EP.exe
File opened (read-only)	\??\X:	EP.exe
File opened (read-only)	\??\Z:	EP.exe
File opened (read-only)	\??\B:	EP.exe
File opened (read-only)	\??\E:	EP.exe
File opened (read-only)	\??\G:	EP.exe
File opened (read-only)	\??\O:	EP.exe
File opened (read-only)	\??\R:	EP.exe
File opened (read-only)	\??\T:	EP.exe
File opened (read-only)	\??\I:	EP.exe
File opened (read-only)	\??\J:	EP.exe
File opened (read-only)	\??\K:	EP.exe
File opened (read-only)	\??\M:	EP.exe
File opened (read-only)	\??\S:	EP.exe
File opened (read-only)	\??\V:	EP.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\YingInstall\409.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Windows\SysWOW64\Ying-UnInstall.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Windows\SysWOW64\Ying-UnInstall.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 3080 set thread context of 1480	3080	EP.exe	102
PID 4304 set thread context of 4820	4304	EP.exe	116
PID 4496 set thread context of 3752	4496	EP.exe	128
PID 4980 set thread context of 4744	4980	EP.exe	143
PID 2704 set thread context of 4316	2704	EP.exe	157
PID 3364 set thread context of 1112	3364	EP.exe	169
PID 1412 set thread context of 4884	1412	EP.exe	184
PID 4504 set thread context of 1512	4504	EP.exe	198
PID 4876 set thread context of 2912	4876	EP.exe	213
PID 2216 set thread context of 2028	2216	EP.exe	227
PID 1740 set thread context of 2744	1740	EP.exe	241
PID 936 set thread context of 4872	936	EP.exe	255
PID 2632 set thread context of 1472	2632	EP.exe	269
PID 2704 set thread context of 1568	2704	EP.exe	283
PID 1672 set thread context of 4632	1672	EP.exe	298

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File created	C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\2.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\winos.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\EP.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\msvcp71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\1.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\2.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\path.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\1.txt	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\name.ini	ttttt.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\name.ini	ttttt.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\log\UpdateNotice.log	winos.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\EP.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\msvcp71.dll	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\path.ini	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File created	C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
File opened for modification	C:\Program Files\²âÊÔ²âÊÔ206\winos.exe	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 61 IoCs

pid	pid_target	Process	procid_target
408	2952	WerFault.exe	84
4780	2956	WerFault.exe	90
4560	5012	WerFault.exe	94
4976	1508	WerFault.exe	99
1876	4960	WerFault.exe	106
4912	3020	WerFault.exe
4352	2372	WerFault.exe	109
4324	64	WerFault.exe	112
4124	1376	WerFault.exe	117
4920	4264	WerFault.exe	119
2100	2448	WerFault.exe	125
3540	1704	WerFault.exe	123
1536	2104	WerFault.exe	131
1020	4516	WerFault.exe	133
1740	3512	WerFault.exe	137
1948	3204	WerFault.exe	140
3820	2512	WerFault.exe	145
3344	2328	WerFault.exe	147
1352	2748	WerFault.exe	151
452	1960	WerFault.exe	154
4492	3956	WerFault.exe	159
4124	1184	WerFault.exe	161
4164	2724	WerFault.exe	165
1156	3328	WerFault.exe	168
1748	5080	WerFault.exe	173
4236	4060	WerFault.exe	175
1348	832	WerFault.exe	179
2788	4104	WerFault.exe	182
1776	3612	WerFault.exe	187
5044	1968	WerFault.exe	189
4448	756	WerFault.exe	193
2584	3792	WerFault.exe	196
3136	4780	WerFault.exe	201
2296	5060	WerFault.exe	203
4488	4952	WerFault.exe	207
548	1748	WerFault.exe	210
1472	1948	WerFault.exe	215
2172	4932	WerFault.exe	216
4504	2300	WerFault.exe	221
2248	3908	WerFault.exe	224
3868	4644	WerFault.exe	229
4808	1156	WerFault.exe	231
3024	4888	WerFault.exe	235
3476	5076	WerFault.exe	238
4384	2000	WerFault.exe	243
2216	2460	WerFault.exe	245
4716	4448	WerFault.exe	249
3040	2068	WerFault.exe	252
4436	1740	WerFault.exe	258
856	3100	WerFault.exe	257
5000	3932	WerFault.exe	263
3832	2312	WerFault.exe	266
4716	1192	WerFault.exe	271
3012	2968	WerFault.exe	272
4072	548	WerFault.exe	277
1340	1460	WerFault.exe	280
4772	2788	WerFault.exe	285
1352	2100	WerFault.exe	287
1356	3136	WerFault.exe	291
3228	432	WerFault.exe	294
1604	4084	WerFault.exe	299

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EP.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	EP.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3468	winos.exe
3468	winos.exe
3468	winos.exe
3468	winos.exe
3468	winos.exe
3468	winos.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe
1480	EP.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	EP.exe
Token: SeDebugPrivilege	4820	EP.exe
Token: SeDebugPrivilege	3752	EP.exe
Token: SeDebugPrivilege	4744	EP.exe
Token: SeDebugPrivilege	4316	EP.exe
Token: SeDebugPrivilege	1112	EP.exe
Token: SeDebugPrivilege	4884	EP.exe
Token: SeDebugPrivilege	1512	EP.exe
Token: SeDebugPrivilege	2912	EP.exe
Token: SeDebugPrivilege	2028	EP.exe
Token: SeDebugPrivilege	2744	EP.exe
Token: SeDebugPrivilege	4872	EP.exe
Token: SeDebugPrivilege	1472	EP.exe
Token: SeDebugPrivilege	1568	EP.exe
Token: SeDebugPrivilege	4632	EP.exe
Token: 33	1480	EP.exe
Token: SeIncBasePriorityPrivilege	1480	EP.exe
Token: 33	1480	EP.exe
Token: SeIncBasePriorityPrivilege	1480	EP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2952	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	84
PID 1560 wrote to memory of 2952	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	84
PID 1560 wrote to memory of 2952	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	84
PID 1560 wrote to memory of 1188	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	88
PID 1560 wrote to memory of 1188	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	88
PID 1560 wrote to memory of 1188	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	88
PID 1560 wrote to memory of 3468	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	89
PID 1560 wrote to memory of 3468	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	89
PID 1560 wrote to memory of 3468	1560	cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe	89
PID 3468 wrote to memory of 2956	3468	winos.exe	90
PID 3468 wrote to memory of 2956	3468	winos.exe	90
PID 3468 wrote to memory of 2956	3468	winos.exe	90
PID 3468 wrote to memory of 3080	3468	winos.exe	98
PID 3468 wrote to memory of 3080	3468	winos.exe	98
PID 3468 wrote to memory of 3080	3468	winos.exe	98
PID 3468 wrote to memory of 1508	3468	winos.exe	99
PID 3468 wrote to memory of 1508	3468	winos.exe	99
PID 3468 wrote to memory of 1508	3468	winos.exe	99
PID 3080 wrote to memory of 1480	3080	EP.exe	102
PID 3080 wrote to memory of 1480	3080	EP.exe	102
PID 3080 wrote to memory of 1480	3080	EP.exe	102
PID 3080 wrote to memory of 1480	3080	EP.exe	102
PID 3080 wrote to memory of 1480	3080	EP.exe	102
PID 3468 wrote to memory of 4960	3468	winos.exe	106
PID 3468 wrote to memory of 4960	3468	winos.exe	106
PID 3468 wrote to memory of 4960	3468	winos.exe	106
PID 3468 wrote to memory of 4304	3468	winos.exe	111
PID 3468 wrote to memory of 4304	3468	winos.exe	111
PID 3468 wrote to memory of 4304	3468	winos.exe	111
PID 3468 wrote to memory of 64	3468	winos.exe	112
PID 3468 wrote to memory of 64	3468	winos.exe	112
PID 3468 wrote to memory of 64	3468	winos.exe	112
PID 4304 wrote to memory of 4820	4304	EP.exe	116
PID 4304 wrote to memory of 4820	4304	EP.exe	116
PID 4304 wrote to memory of 4820	4304	EP.exe	116
PID 4304 wrote to memory of 4820	4304	EP.exe	116
PID 4304 wrote to memory of 4820	4304	EP.exe	116
PID 3468 wrote to memory of 4264	3468	winos.exe	119
PID 3468 wrote to memory of 4264	3468	winos.exe	119
PID 3468 wrote to memory of 4264	3468	winos.exe	119
PID 3468 wrote to memory of 4496	3468	winos.exe	124
PID 3468 wrote to memory of 4496	3468	winos.exe	124
PID 3468 wrote to memory of 4496	3468	winos.exe	124
PID 3468 wrote to memory of 2448	3468	winos.exe	125
PID 3468 wrote to memory of 2448	3468	winos.exe	125
PID 3468 wrote to memory of 2448	3468	winos.exe	125
PID 4496 wrote to memory of 3752	4496	EP.exe	128
PID 4496 wrote to memory of 3752	4496	EP.exe	128
PID 4496 wrote to memory of 3752	4496	EP.exe	128
PID 4496 wrote to memory of 3752	4496	EP.exe	128
PID 4496 wrote to memory of 3752	4496	EP.exe	128
PID 3468 wrote to memory of 4516	3468	winos.exe	133
PID 3468 wrote to memory of 4516	3468	winos.exe	133
PID 3468 wrote to memory of 4516	3468	winos.exe	133
PID 3468 wrote to memory of 4980	3468	winos.exe	139
PID 3468 wrote to memory of 4980	3468	winos.exe	139
PID 3468 wrote to memory of 4980	3468	winos.exe	139
PID 3468 wrote to memory of 3204	3468	winos.exe	140
PID 3468 wrote to memory of 3204	3468	winos.exe	140
PID 3468 wrote to memory of 3204	3468	winos.exe	140
PID 4980 wrote to memory of 4744	4980	EP.exe	143
PID 4980 wrote to memory of 4744	4980	EP.exe	143
PID 4980 wrote to memory of 4744	4980	EP.exe	143
PID 4980 wrote to memory of 4744	4980	EP.exe	143

C:\Users\Admin\AppData\Local\Temp\cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe
"C:\Users\Admin\AppData\Local\Temp\cd03561d6e2b4a75d5113465d7c9748aa754e04dfad77e29a2cabc9cb8a58cf7.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe
  "C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 596
    3⤵
    - Program crash
    PID:408
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\²âÊÔ²âÊÔ206\Ë°.txt
  2⤵
  PID:1188
- C:\Program Files\²âÊÔ²âÊÔ206\winos.exe
  "C:\Program Files\²âÊÔ²âÊÔ206\winos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 232
      4⤵
      Program crash
      PID:4780
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 196
      4⤵
      Program crash
      PID:4976
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 196
      4⤵
      Program crash
      PID:1876
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:64
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 196
      4⤵
      Program crash
      PID:4324
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 196
      4⤵
      Program crash
      PID:4920
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3752
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 204
      4⤵
      Program crash
      PID:2100
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4516
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 196
      4⤵
      Program crash
      PID:1020
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3204
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 196
      4⤵
      Program crash
      PID:1948
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 196
      4⤵
      Program crash
      PID:3344
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:2704
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 196
      4⤵
      Program crash
      PID:452
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 196
      4⤵
      Program crash
      PID:4124
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:3364
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 204
      4⤵
      Program crash
      PID:1156
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 196
      4⤵
      Program crash
      PID:4236
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1412
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 196
      4⤵
      Program crash
      PID:2788
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 196
      4⤵
      Program crash
      PID:5044
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4504
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:3792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 196
      4⤵
      Program crash
      PID:2584
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 196
      4⤵
      Program crash
      PID:2296
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4876
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:1748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 196
      4⤵
      Program crash
      PID:548
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:4932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 196
      4⤵
      Program crash
      PID:2172
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2216
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:3908
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 196
      4⤵
      Program crash
      PID:2248
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 200
      4⤵
      Program crash
      PID:4808
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:1740
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2744
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:5076
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 196
      4⤵
      Program crash
      PID:3476
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:2460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 204
      4⤵
      Program crash
      PID:2216
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:936
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:2068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 196
      4⤵
      Program crash
      PID:3040
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:1740
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 196
      4⤵
      Program crash
      PID:4436
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2632
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:2312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 196
      4⤵
      Program crash
      PID:3832
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:2968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 196
      4⤵
      Program crash
      PID:3012
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2704
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:1460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 200
      4⤵
      Program crash
      PID:1340
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:2100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 196
      4⤵
      Program crash
      PID:1352
- - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
    "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:1672
  - - C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
      "C:\Program Files\²âÊÔ²âÊÔ206\EP.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
    "C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe"
    3⤵
    PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 196
      4⤵
      Program crash
      PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2952 -ip 2952
1⤵
PID:2740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2956 -ip 2956
1⤵
PID:2860

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "[wØ)N@öb"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 228
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5012 -ip 5012
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1508 -ip 1508
1⤵
PID:2880

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "x"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 228
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3020 -ip 3020
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4960 -ip 4960
1⤵
PID:1820

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "ôßRà¸Px"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 228
  2⤵
  - Program crash
  PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2372 -ip 2372
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 64 -ip 64
1⤵
PID:432

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 228
  2⤵
  - Program crash
  PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1376 -ip 1376
1⤵
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4264 -ip 4264
1⤵
PID:2312

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 228
  2⤵
  - Program crash
  PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1704 -ip 1704
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2448 -ip 2448
1⤵
PID:5096

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 228
  2⤵
  - Program crash
  PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2104 -ip 2104
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4516 -ip 4516
1⤵
PID:2540

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 228
  2⤵
  - Program crash
  PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3512 -ip 3512
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3204 -ip 3204
1⤵
PID:428

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 228
  2⤵
  - Program crash
  PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2512 -ip 2512
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2328 -ip 2328
1⤵
PID:2136

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 228
  2⤵
  - Program crash
  PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2748 -ip 2748
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1960 -ip 1960
1⤵
PID:3228

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 228
  2⤵
  - Program crash
  PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3956 -ip 3956
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1184 -ip 1184
1⤵
PID:2680

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 228
  2⤵
  - Program crash
  PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2724 -ip 2724
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3328 -ip 3328
1⤵
PID:4524

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 228
  2⤵
  - Program crash
  PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5080 -ip 5080
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4060 -ip 4060
1⤵
PID:4952

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 228
  2⤵
  - Program crash
  PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 832 -ip 832
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4104 -ip 4104
1⤵
PID:744

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 232
  2⤵
  - Program crash
  PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3612 -ip 3612
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1968 -ip 1968
1⤵
PID:4352

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "L‡UPŸR"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 228
  2⤵
  - Program crash
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 756 -ip 756
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3792 -ip 3792
1⤵
PID:2124

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 236
  2⤵
  - Program crash
  PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4780 -ip 4780
1⤵
PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5060 -ip 5060
1⤵
PID:4772

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "ŒŽUPŸR"
1⤵
- Executes dropped EXE
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 228
  2⤵
  - Program crash
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4952 -ip 4952
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1748 -ip 1748
1⤵
PID:4888

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
PID:1948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 228
  2⤵
  - Program crash
  PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1948 -ip 1948
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4932 -ip 4932
1⤵
PID:3228

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "\UPŸR"
1⤵
- Executes dropped EXE
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 236
  2⤵
  - Program crash
  PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2300 -ip 2300
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3908 -ip 3908
1⤵
PID:4124

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
PID:4644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 228
  2⤵
  - Program crash
  PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4644 -ip 4644
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1156 -ip 1156
1⤵
PID:4164

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
- Executes dropped EXE
PID:4888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 228
  2⤵
  - Program crash
  PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4888 -ip 4888
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5076 -ip 5076
1⤵
PID:4852

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "èMU"
1⤵
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 228
  2⤵
  - Program crash
  PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2000 -ip 2000
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2460 -ip 2460
1⤵
PID:1928

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" "lö°/M¼Çw "
1⤵
PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 228
  2⤵
  - Program crash
  PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4448 -ip 4448
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2068 -ip 2068
1⤵
PID:2700

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 228
  2⤵
  - Program crash
  PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3100 -ip 3100
1⤵
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1740 -ip 1740
1⤵
PID:1696

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:3932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 228
  2⤵
  - Program crash
  PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3932 -ip 3932
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2312 -ip 2312
1⤵
PID:2944

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 228
  2⤵
  - Program crash
  PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1192 -ip 1192
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2968 -ip 2968
1⤵
PID:4488

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 228
  2⤵
  - Program crash
  PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 548 -ip 548
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1460 -ip 1460
1⤵
PID:2276

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:2788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 228
  2⤵
  - Program crash
  PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2788 -ip 2788
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2100 -ip 2100
1⤵
PID:1604

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:3136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 228
  2⤵
  - Program crash
  PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3136 -ip 3136
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 432 -ip 432
1⤵
PID:2276

C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe
"C:\Program Files (x86)\GmtWGujS\WeGameApps\ÄæÕ½\TCLS\Client.exe" ""
1⤵
PID:4084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 228
  2⤵
  - Program crash
  PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4084 -ip 4084
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.txt

Path C:\Program Files\²âÊÔ²âÊÔ206\1.txt
Size 2.2MB
SHA256 6a11cca02e22b01b077775b9819cb220d3747c0f6d2b0b85b13265d0cd3ab730
MD5 cd55a17685b496570a9ba3374730a9c5
SHA1 3127c701297667727854b508a99c71a77fb1f0ea
SHA512 19cee89ec5256a386c36c6b3b02f91e8acbf19a778427e5ead10614e73d1dc5e9ed64b1b3b5ad5b461828dea77ba69a5d6b6c8a2363b727ad04f0215da55d894
SSDEEP 24576:9yU6Wf0M6vRbFZ3TuU/upIcG3cK7IYwIJ/4sH6riuAFpivfctOADWEgdrKzQKTP/:Ve4ldYWE6rKhTeQyKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

12345678.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\12345678.exe
Size 302KB
SHA256 f8b93502b5d4a2d8180acd6bdf0a855146df0eeec437dfa3b5ee35059d8791a3
MD5 570fb4a8e2736f584ecb71fce7b66a0d
SHA1 1e41a32a754a0dc02e33f79693358f88240d3993
SHA512 678180dc0c63abf26abcd1ea4fbd9babbefb34ed74032ec67a667ce0597186ae11669d7b3961d1dfece881163f8bf6ed7877c31e823b2e422e66538cab9529a3
SSDEEP 6144:yjj3ndpuFbE1idOakOQ6TIeAe+7xxeI89cg7e9mRcnxU7fMZ2TrJK4IKQTcLLmJj:W3n6FbEsd77TIea7Lc997e5U7vTrWwLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DTLUI.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\DTLUI.dll
Size 2.4MB
SHA256 0989c2b74aab08c0e8ec997e5535c39ef1eab45ec829da7c1421624cd1f0f2dd
MD5 42d8e9a3d01b2150856bd4025a546748
SHA1 96284f7b91db099f954966622273d2a8228de805
SHA512 db6bc1d7cc87ce26bba8c3ca2c4cd976b592bb579a80df52e902389d5c3da693a10c616ee2fd21fdebb7d93d231b36bf1850a19c17134b68c878fa638adc4327
SSDEEP 49152:Xr3qLBWKt1J//gRVRR3nGmDiXv2hB2IUF8tcdqOt:XratWQ1t/IVRRWvXv2hB2d8tcdqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

EP.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\EP.exe
Size 1.1MB
SHA256 37865f209c91b291282c51515a868e6993070d3d7594cf931b42f5a6a8f09a3a
MD5 4ddce14e5c6c09bbe5154167a74d271e
SHA1 3985cd3c8b49fcaa9c9dd244ef53d9e86889a3ad
SHA512 f49cf8709fbc1a507416cc61c0678cf153d8fab38527d8e9eece7619196e4c194be437e57de635bea511cdcde7bc62469380f97005b7202c625ae6ceb70b610b
SSDEEP 12288:rmFzj/Jm4rhXkMuDop9rCisKcrDORyqA8EgNFAGU:qFf/Jm4rlkMusfiKcXOkuAGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP71.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\MSVCP71.dll
Size 2.4MB
SHA256 9c94d54a5e1518a63e4b96ab69d11a2167ec86b0d8bacc6d43f33758a36a9831
MD5 6e1640ffcc9d52c45189390c91411396
SHA1 3e6e74aa524f9464388e8bd07697ade758b4d2eb
SHA512 d1fbbdd3445e6c61f12e8ddedc004affac5dec5f1a44322b15f287b5c4d4b4a98ec0ef28f6a28586df9f912382b514f0a5de20f36d4d405d194034082fd535ce
SSDEEP 49152:/ozplzacxiV113RDU6vNpvb2rE5uf0zf7/oX8c:/ozrh4VH3RDU6lpvb2rE5uSf7/o
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPFarmer.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\XPFarmer.bpl
Size 1.5MB
SHA256 b8d383284ee56e69af969aeb332a3efc5a1318552925962ec9bbcd85fa6deaec
MD5 56e4471fd4eb35e5eda4537bdf5b9b17
SHA1 8437cbb230195463d7e543d45908927022f95f21
SHA512 77979fc6b9d2ffd225efcf202d7dc61132dd1efc755069ce0121b59d4ac58102e8cf932add16721589f4085ce1408513ed1ff0df4fa508bc98a17621be5cb44d
SSDEEP 12288:6zC29ELzScwv9gU5kcoXq1dhpAntAhXcZP5aNyCqBPN4vRgQ3gqX8aE05mtiB7YA:fFwv9RLs4tDYn7JnNs6kBb7ELq
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr71.dll

Path C:\Program Files\²âÊÔ²âÊÔ206\msvcr71.dll
Size 340KB
SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
MD5 86f1895ae8c5e8b17d99ece768a70732
SHA1 d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA512 3b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
SSDEEP 6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.ini

Path C:\Program Files\²âÊÔ²âÊÔ206\name.ini
Size 29B
SHA256 7f1048dee71c4041c6f6e5c0a781f5faacef5cd11948d29a0db6c78967155098
MD5 965e8bc6cc7f7df8a6da1b01ab203658
SHA1 cb1dc1c350a6ea5a120a0f3554895507dbd0c1b6
SHA512 4a10fc176a92d92c8ebaca5e5178feb783ca1bc0594803cc2fb0b0f38fb2ac50ea115a7f46709d75bda3ec3f21850284c2e98ae18b2f4310f475c5e7a1b3ead0
MD5 SHA1 SHA512

Submit Download

path.ini

Path C:\Program Files\²âÊÔ²âÊÔ206\path.ini
Size 50B
SHA256 fe79c97ec4aa72e7f458c69662132ab81a99d36d03e511ec429403fe853a6a94
MD5 5f5903b084bb82c2b983ec909a1562a5
SHA1 937ee201ce7e6d53666440fc8a4f933117b0b0e7
SHA512 84d309a4be0e644304b0857ecee488899e5eaf6b43e5542154e228b6c2c6329d42bd014d0d9c667aa7cdfd4716f23438703e2e0b1928cf1aef71a0824701abb5
MD5 SHA1 SHA512

Submit Download

rtl70.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\rtl70.bpl
Size 640KB
SHA256 b8c41a8e2824c21b4e3eaa901e1af8c772ab0e68d1bf07580da62969792af5a2
MD5 ea8738b2908a2dd7d15df834d6008d26
SHA1 1ccfdb3f2647bbfa4fb638bc17ae01092b287bf1
SHA512 4091c1f21d08e5d37694ce9b395f38b6f07c9f2dd466a268ee4feae42743ac02c420abd631977f75f41b9d461234e690283979934a66f9e52bccd61dfc3b3981
SSDEEP 6144:QNIkZ4jZJiC9mkKP/q3JjpnWdjU3eDz+XmkmstRU:cIkZ4jZJ+gpF3a+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttttt.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\ttttt.exe
Size 262KB
SHA256 a5622e2bf46cc2ec90c4dca70372f051bfb5bf55da3788b5dfca9429529d285b
MD5 9f1d3dfac55080c712c0281fb2eeeb47
SHA1 9109f9457f811d8d0e887469ffc9c2af793e8090
SHA512 7e2df7f2aff2d95ca1dbe0dfb7c8c9388c7e8c023c8b9af9b6997140cefcca63fe5980a438b70da03ab6672c94033fb4e50d407c54530b5ce0b9169c39c50879
SSDEEP 6144:zPH9yqri3YL1Avg3NloWPx9L8FXLOcautvT0euR:zPgqri3YL1Avg3NloWPrwXLOv9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcl70.bpl

Path C:\Program Files\²âÊÔ²âÊÔ206\vcl70.bpl
Size 1.3MB
SHA256 a7a26cbf6968063c51d4d70f4599f295e4a88e352f19bdd475f3416e6411c390
MD5 16a1c27ed415d1816f8888ea2cefb3f6
SHA1 80db800b805d548f6df4eb2cb37ba2064dc37c05
SHA512 68a3e563dd9745210eb7295cde692af68cd5fc430a95856f4823dc10e42d067f332ae1d2445e8810e0c15c3c779e195735bd311c45e9690cb05dbedcd7354306
SSDEEP 12288:HYURhofl6VUvxusfIuJ25+G1gMBpSFxZTemnMc3YB4gisIKXKjj5Oby17fGlC:Hof30jJBpSfZyWIGBsKH5ObC4C
MD5 SHA1 SHA512 SSDEEP

Submit Download

winos.exe

Path C:\Program Files\²âÊÔ²âÊÔ206\winos.exe
Size 216KB
SHA256 a937d9295271cc131a2e019dd41ce4ead3bca2d5115fb7d7482508297971b17e
MD5 5ac2deb3ceb9e32fe681483373c2d4c7
SHA1 ed4e9af7c4f3e462e41f542c1ef7d0c3c0613769
SHA512 43d4ce96a3c5b5f3e234df70e365e05cdf416f57e262ae70ea1b04450eb397f38ed8db45a8d5df630e759c8e4a3642ad26c9d897d312085c5fcf8703e20162b7
SSDEEP 3072:wTXcjTL9E//UGgLIMy6P8Qmt5UYy7o6p48gao6p48gRlSSHjyGf1hM2F2:eXCE//UGgLZycDp7BgaBgLpftY
MD5 SHA1 SHA512 SSDEEP

Submit Download

20240613015859373~YingInstall-TopFramePicture.bmp

Path C:\Users\Admin\AppData\Local\Temp\20240613015859373~YingInstall-TopFramePicture.bmp
Size 563KB
SHA256 d9295a5e215cf9f1c2dd5b9aa5deb1ee46619202b5814296ca73777506846608
MD5 a528a1efb19f5bee2fa74cd8650dab24
SHA1 51b72c994283ec899a32732bc60655d3039138a8
SHA512 bcf8db6c25868a5d48ef887046143ed504690084673ff71c886dc17de8f65482e773b3a5867cab89e310ac03f1a37f3661d1117230fbcb7d85071fcf2b34c15a
SSDEEP 3072:i3GXZRy5KkGe3JFgTvwq8cO8jLR6qQl0p88aaF85hbKCNZTB606u2:i3y3O5mfOR9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1480-109-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1480-105-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1480-103-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1480-106-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1480-114-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1480-113-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/1480-108-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/2704-193-0x00000000009C0000-0x0000000000B3B000-memory.dmp

Download

memory/2952-70-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2952-60-0x0000000000400000-0x0000000000456000-memory.dmp

Download

memory/2956-84-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/2956-78-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/3080-112-0x00000000009A0000-0x0000000000B1B000-memory.dmp

Download

memory/3080-110-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3080-101-0x00000000009A0000-0x0000000000B1B000-memory.dmp

Download

memory/3080-111-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/3752-173-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/3752-174-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/3752-175-0x0000000000450000-0x0000000000519000-memory.dmp

Download

memory/4304-144-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/4304-145-0x0000000000980000-0x0000000000AFB000-memory.dmp

Download

memory/4304-133-0x0000000000980000-0x0000000000AFB000-memory.dmp

Download

memory/4304-143-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/4496-160-0x00000000008E0000-0x0000000000A5B000-memory.dmp

Download

memory/4496-172-0x00000000008E0000-0x0000000000A5B000-memory.dmp

Download

memory/4496-171-0x00000000400C0000-0x0000000040218000-memory.dmp

Download

memory/4496-170-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/4744-189-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4744-190-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4780-248-0x0000000000400000-0x0000000000632000-memory.dmp

Download

memory/4820-146-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4820-147-0x0000000010000000-0x000000001018F000-memory.dmp

Download

memory/4820-148-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4980-187-0x00000000400C0000-0x0000000040218000-memory.dmp

Download