Analysis
-
max time kernel
62s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 08:36
Static task
static1
Behavioral task
behavioral1
Sample
yfga_game.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
yfga_game.exe
Resource
win10v2004-20240709-en
General
-
Target
yfga_game.exe
-
Size
10.7MB
-
MD5
1864d9c2373236602ff186c28889d8f5
-
SHA1
28d619fb21f1ed64cc054ba81793aba9e3743487
-
SHA256
144c2e379f3876600e29384f71cbf9edb53ac3e45dee369b1f99e78476986254
-
SHA512
fdca345551700fbe893df0f6451995d70ce105ca2659a3da6ce355fb5c1b1c65cbbb1a0b04424d677444e6db8d58e3fa2d8d5db39ac64a1d4e308e49510865f8
-
SSDEEP
196608:ZO81jWusNrPGC0ePjqHbUjHicQskqPe1Cxcxk3ZAEUadzR8yc4ghrk:88tWhTr0eqgDiDjqG1Fxk3mEUadzRURi
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4992 takeown.exe 452 icacls.exe 3628 takeown.exe 4508 icacls.exe -
Processes:
resource yara_rule C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\screenscrew.exe aspack_v212_v242 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exewin7recovery.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation win7recovery.exe -
Executes dropped EXE 8 IoCs
Processes:
screenscrew.exejokewarehydra.exewalliant.exewalliant.tmpwin7recovery.exeuseroverflow.exeprogramoverflow.exeWbVhxCIDDK.exepid process 1704 screenscrew.exe 3032 jokewarehydra.exe 3392 walliant.exe 8 walliant.tmp 508 win7recovery.exe 2144 useroverflow.exe 4468 programoverflow.exe 1504 WbVhxCIDDK.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4992 takeown.exe 452 icacls.exe 3628 takeown.exe 4508 icacls.exe -
Processes:
resource yara_rule behavioral2/memory/508-82-0x0000000000600000-0x0000000000678000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
win7recovery.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WbVhxCIDDK = "C:\\ProgramData\\WbVhxCIDDK.exe" win7recovery.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\System32\\FeatureToastBulldogImg.png" reg.exe -
Drops file in Windows directory 2 IoCs
Processes:
xcopy.exemspaint.exedescription ioc process File created C:\Windows\Boot\Fonts\segoe_slboot.ttf xcopy.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3164 508 WerFault.exe win7recovery.exe 1896 508 WerFault.exe win7recovery.exe 4720 508 WerFault.exe win7recovery.exe 2544 508 WerFault.exe win7recovery.exe 2068 508 WerFault.exe win7recovery.exe 1004 508 WerFault.exe win7recovery.exe 4844 508 WerFault.exe win7recovery.exe 4136 508 WerFault.exe win7recovery.exe 3540 1504 WerFault.exe WbVhxCIDDK.exe 1152 508 WerFault.exe win7recovery.exe 2756 508 WerFault.exe win7recovery.exe 2928 508 WerFault.exe win7recovery.exe 444 508 WerFault.exe win7recovery.exe 2508 508 WerFault.exe win7recovery.exe 1748 508 WerFault.exe win7recovery.exe 3372 508 WerFault.exe win7recovery.exe 2784 508 WerFault.exe win7recovery.exe 4048 508 WerFault.exe win7recovery.exe 4044 508 WerFault.exe win7recovery.exe 1296 508 WerFault.exe win7recovery.exe 4072 508 WerFault.exe win7recovery.exe 4968 508 WerFault.exe win7recovery.exe 1612 508 WerFault.exe win7recovery.exe 1288 508 WerFault.exe win7recovery.exe 1748 508 WerFault.exe win7recovery.exe 1188 508 WerFault.exe win7recovery.exe 3880 508 WerFault.exe win7recovery.exe 4444 508 WerFault.exe win7recovery.exe 112 508 WerFault.exe win7recovery.exe 2268 508 WerFault.exe win7recovery.exe 4476 508 WerFault.exe win7recovery.exe 2848 508 WerFault.exe win7recovery.exe 3436 508 WerFault.exe win7recovery.exe 4064 508 WerFault.exe win7recovery.exe 392 508 WerFault.exe win7recovery.exe 2128 508 WerFault.exe win7recovery.exe 4916 508 WerFault.exe win7recovery.exe 5048 508 WerFault.exe win7recovery.exe 1448 508 WerFault.exe win7recovery.exe 1476 508 WerFault.exe win7recovery.exe 2956 508 WerFault.exe win7recovery.exe 4812 508 WerFault.exe win7recovery.exe 2540 508 WerFault.exe win7recovery.exe 4620 508 WerFault.exe win7recovery.exe 3820 508 WerFault.exe win7recovery.exe 3028 508 WerFault.exe win7recovery.exe 4136 508 WerFault.exe win7recovery.exe 1604 508 WerFault.exe win7recovery.exe 3568 508 WerFault.exe win7recovery.exe 1964 508 WerFault.exe win7recovery.exe 536 508 WerFault.exe win7recovery.exe 2376 508 WerFault.exe win7recovery.exe 4424 508 WerFault.exe win7recovery.exe 208 508 WerFault.exe win7recovery.exe 1440 508 WerFault.exe win7recovery.exe 5064 508 WerFault.exe win7recovery.exe 4516 508 WerFault.exe win7recovery.exe 4812 508 WerFault.exe win7recovery.exe 3864 508 WerFault.exe win7recovery.exe 584 508 WerFault.exe win7recovery.exe 828 508 WerFault.exe win7recovery.exe 4048 508 WerFault.exe win7recovery.exe 1940 508 WerFault.exe win7recovery.exe 1984 508 WerFault.exe win7recovery.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 460 timeout.exe 5108 timeout.exe 4968 timeout.exe 536 timeout.exe 3052 timeout.exe 4608 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4220 taskkill.exe 2900 taskkill.exe 2400 taskkill.exe 3036 taskkill.exe 2500 taskkill.exe 1612 taskkill.exe 2036 taskkill.exe -
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Download win7recovery.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" win7recovery.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings cmd.exe -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 376 regedit.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mspaint.exewin7recovery.exeWbVhxCIDDK.exepid process 4660 mspaint.exe 4660 mspaint.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe 508 win7recovery.exe 508 win7recovery.exe 1504 WbVhxCIDDK.exe 1504 WbVhxCIDDK.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
win7recovery.exepid process 508 win7recovery.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4220 taskkill.exe Token: SeDebugPrivilege 2900 taskkill.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
jokewarehydra.exenotepad.exepid process 3032 jokewarehydra.exe 3032 jokewarehydra.exe 3032 jokewarehydra.exe 3032 jokewarehydra.exe 3032 jokewarehydra.exe 1880 notepad.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
mspaint.exewin7recovery.exepid process 4660 mspaint.exe 4660 mspaint.exe 4660 mspaint.exe 4660 mspaint.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe 508 win7recovery.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
yfga_game.execmd.execmd.exewalliant.exedescription pid process target process PID 2816 wrote to memory of 1368 2816 yfga_game.exe cmd.exe PID 2816 wrote to memory of 1368 2816 yfga_game.exe cmd.exe PID 2816 wrote to memory of 1368 2816 yfga_game.exe cmd.exe PID 1368 wrote to memory of 1704 1368 cmd.exe screenscrew.exe PID 1368 wrote to memory of 1704 1368 cmd.exe screenscrew.exe PID 1368 wrote to memory of 1704 1368 cmd.exe screenscrew.exe PID 1368 wrote to memory of 4992 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 4992 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 4992 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 452 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 452 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 452 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 544 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 544 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 544 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 3628 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 3628 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 3628 1368 cmd.exe takeown.exe PID 544 wrote to memory of 3032 544 cmd.exe jokewarehydra.exe PID 544 wrote to memory of 3032 544 cmd.exe jokewarehydra.exe PID 544 wrote to memory of 3032 544 cmd.exe jokewarehydra.exe PID 1368 wrote to memory of 3392 1368 cmd.exe walliant.exe PID 1368 wrote to memory of 3392 1368 cmd.exe walliant.exe PID 1368 wrote to memory of 3392 1368 cmd.exe walliant.exe PID 1368 wrote to memory of 4508 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 4508 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 4508 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 1124 1368 cmd.exe xcopy.exe PID 1368 wrote to memory of 1124 1368 cmd.exe xcopy.exe PID 1368 wrote to memory of 1124 1368 cmd.exe xcopy.exe PID 3392 wrote to memory of 8 3392 walliant.exe walliant.tmp PID 3392 wrote to memory of 8 3392 walliant.exe walliant.tmp PID 3392 wrote to memory of 8 3392 walliant.exe walliant.tmp PID 544 wrote to memory of 1244 544 cmd.exe WScript.exe PID 544 wrote to memory of 1244 544 cmd.exe WScript.exe PID 544 wrote to memory of 1244 544 cmd.exe WScript.exe PID 1368 wrote to memory of 1412 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1412 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1412 1368 cmd.exe reg.exe PID 1368 wrote to memory of 4220 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 4220 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 4220 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2900 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2900 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2900 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2400 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2400 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 2400 1368 cmd.exe taskkill.exe PID 1368 wrote to memory of 460 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 460 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 460 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 4552 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 4552 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 4552 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 3252 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 3252 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 3252 1368 cmd.exe cmd.exe PID 1368 wrote to memory of 5108 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 5108 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 5108 1368 cmd.exe timeout.exe PID 1368 wrote to memory of 636 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 636 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 636 1368 cmd.exe shutdown.exe PID 1368 wrote to memory of 4968 1368 cmd.exe timeout.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
win7recovery.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System win7recovery.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" win7recovery.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\YFGA.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\screenscrew.exescreenscrew.exe3⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\SysWOW64\takeown.exetakeown C:\Windows\System32\logonui.exe Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4992 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\System32\logonui.exe Grant:\Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K hydra.cmd3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\jokewarehydra.exejokewarehydra.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3032 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\annoy3.vbs"4⤵PID:1244
-
C:\Windows\SysWOW64\takeown.exetakeown C:\Windows\Boot\Fonts\* Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3628 -
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\walliant.exewalliant.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\is-QD279.tmp\walliant.tmp"C:\Users\Admin\AppData\Local\Temp\is-QD279.tmp\walliant.tmp" /SL5="$602C2,4511977,830464,C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\walliant.exe"4⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Boot\Fonts\* Grant:\Admin3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4508 -
C:\Windows\SysWOW64\xcopy.exexcopy C:\Windows\Fonts\seguisym.ttf C:\Windows\Boot\Fonts\segoe_slboot.ttf /y3⤵
- Drops file in Windows directory
- Enumerates system info in registry
PID:1124 -
C:\Windows\SysWOW64\reg.exereg import reg.reg3⤵
- Sets desktop wallpaper using registry
PID:1412 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im fontdrvhost.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TextInputhost.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2900 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
PID:2400 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:460 -
C:\Windows\SysWOW64\shutdown.exeshutdown /r /t 30000 /c "HAHA I HACKED YOU AYFGA ROCKS YOU"3⤵PID:4552
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K spam.bat "forkbomb" /min3⤵PID:3252
-
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:5108 -
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:636
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:4968 -
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\win7recovery.exewin7recovery.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 6764⤵
- Program crash
PID:3164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 8524⤵
- Program crash
PID:1896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 10004⤵
- Program crash
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 8484⤵
- Program crash
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 10004⤵
- Program crash
PID:2068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 10804⤵
- Program crash
PID:1004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 10924⤵
- Program crash
PID:4844 -
C:\ProgramData\WbVhxCIDDK.exe"C:\ProgramData\WbVhxCIDDK.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 5845⤵
- Program crash
PID:3540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 12124⤵
- Program crash
PID:4136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 15924⤵
- Program crash
PID:1152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17204⤵
- Program crash
PID:2756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17124⤵
- Program crash
PID:2928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18324⤵
- Program crash
PID:444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 20244⤵
- Program crash
PID:2508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 21324⤵
- Program crash
PID:1748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 21604⤵
- Program crash
PID:3372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22044⤵
- Program crash
PID:2784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 20044⤵
- Program crash
PID:4048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17364⤵
- Program crash
PID:4044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18684⤵
- Program crash
PID:1296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18964⤵
- Program crash
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17244⤵
- Program crash
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14724⤵
- Program crash
PID:1612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14644⤵
- Program crash
PID:1288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14644⤵
- Program crash
PID:1748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19564⤵
- Program crash
PID:1188 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22044⤵
- Program crash
PID:3880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14644⤵
- Program crash
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19684⤵
- Program crash
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22884⤵
- Program crash
PID:2268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23324⤵
- Program crash
PID:4476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 14724⤵
- Program crash
PID:2848 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19964⤵
- Program crash
PID:3436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19604⤵
- Program crash
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19604⤵
- Program crash
PID:392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 16164⤵
- Program crash
PID:2128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17244⤵
- Program crash
PID:4916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 21804⤵
- Program crash
PID:5048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17404⤵
- Program crash
PID:1448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19884⤵
- Program crash
PID:1476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19244⤵
- Program crash
PID:2956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18684⤵
- Program crash
PID:4812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23124⤵
- Program crash
PID:2540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18844⤵
- Program crash
PID:4620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18844⤵
- Program crash
PID:3820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 21124⤵
- Program crash
PID:3028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17604⤵
- Program crash
PID:4136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23524⤵
- Program crash
PID:1604 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17884⤵
- Program crash
PID:3568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22844⤵
- Program crash
PID:1964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 24244⤵
- Program crash
PID:536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17164⤵
- Program crash
PID:2376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19444⤵
- Program crash
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23364⤵
- Program crash
PID:208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22724⤵
- Program crash
PID:1440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 18844⤵
- Program crash
PID:5064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 19244⤵
- Program crash
PID:4516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 20084⤵
- Program crash
PID:4812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23364⤵
- Program crash
PID:3864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17284⤵
- Program crash
PID:584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23604⤵
- Program crash
PID:828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22884⤵
- Program crash
PID:4048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22844⤵
- Program crash
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 21804⤵
- Program crash
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 24244⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17084⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 20164⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23044⤵PID:460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22844⤵PID:796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 24324⤵PID:536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23684⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23444⤵PID:1488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 17164⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22404⤵PID:1188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22404⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 23164⤵PID:3388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 22084⤵PID:2032
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵
- Kills process with taskkill
PID:3036 -
C:\Windows\SysWOW64\timeout.exetimeout 123⤵
- Delays execution with timeout.exe
PID:536 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3052 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
PID:2500 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe3⤵
- Kills process with taskkill
PID:1612 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im WScript.exe3⤵
- Kills process with taskkill
PID:2036 -
C:\Windows\SysWOW64\shutdown.exeshutdown /a3⤵PID:2140
-
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\useroverflow.exeuseroverflow.exe3⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\Desktop\yfga_game_5371cdf5-6001-436a-b2f9-f94b86d9ddb4\programoverflow.exeprogramoverflow.exe3⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Suspicious use of FindShellTrayWindow
PID:1880 -
C:\Windows\SysWOW64\regedit.exeregedit.exe3⤵
- Runs regedit.exe
PID:376 -
C:\Windows\SysWOW64\mspaint.exemspaint.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4660 -
C:\Windows\SysWOW64\charmap.execharmap.exe3⤵PID:4912
-
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- Delays execution with timeout.exe
PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 508 -ip 5081⤵PID:1548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 508 -ip 5081⤵PID:3960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:4060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 508 -ip 5081⤵PID:4308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 508 -ip 5081⤵PID:3756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 508 -ip 5081⤵PID:1960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 508 -ip 5081⤵PID:4940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1504 -ip 15041⤵PID:3388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:1520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 508 -ip 5081⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:2292
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 508 -ip 5081⤵PID:1892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 508 -ip 5081⤵PID:4080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 508 -ip 5081⤵PID:4564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 508 -ip 5081⤵PID:828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 508 -ip 5081⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 508 -ip 5081⤵PID:1604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:4064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 508 -ip 5081⤵PID:932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:2900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 508 -ip 5081⤵PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 508 -ip 5081⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 508 -ip 5081⤵PID:2312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 508 -ip 5081⤵PID:588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 508 -ip 5081⤵PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 508 -ip 5081⤵PID:4008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 508 -ip 5081⤵PID:212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 508 -ip 5081⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 508 -ip 5081⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 508 -ip 5081⤵PID:1296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 508 -ip 5081⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 508 -ip 5081⤵PID:404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 508 -ip 5081⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 508 -ip 5081⤵PID:3644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 508 -ip 5081⤵PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 508 -ip 5081⤵PID:3560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 508 -ip 5081⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 508 -ip 5081⤵PID:3188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 508 -ip 5081⤵PID:584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 508 -ip 5081⤵PID:828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 508 -ip 5081⤵PID:2784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 508 -ip 5081⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:4744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 508 -ip 5081⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 508 -ip 5081⤵PID:4552
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 508 -ip 5081⤵PID:4356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 508 -ip 5081⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 508 -ip 5081⤵PID:3632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 508 -ip 5081⤵PID:3420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 508 -ip 5081⤵PID:4912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 508 -ip 5081⤵PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 508 -ip 5081⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 508 -ip 5081⤵PID:452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 508 -ip 5081⤵PID:4444
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 508 -ip 5081⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 508 -ip 5081⤵PID:3672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 508 -ip 5081⤵PID:3820
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 508 -ip 5081⤵PID:4888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 508 -ip 5081⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 508 -ip 5081⤵PID:1396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 508 -ip 5081⤵PID:3196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 508 -ip 5081⤵PID:1604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 508 -ip 5081⤵PID:2856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 508 -ip 5081⤵PID:4072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 508 -ip 5081⤵PID:1196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 508 -ip 5081⤵PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 508 -ip 5081⤵PID:1368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 508 -ip 5081⤵PID:1464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 508 -ip 5081⤵PID:4912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 508 -ip 5081⤵PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 508 -ip 5081⤵PID:1812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 508 -ip 5081⤵PID:4796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114B
MD5d725d85cc5f30c0f695b03a9e7d0c4c0
SHA1131b68adcddb7ff3b3ce9c34c5277eb5d673f610
SHA2564d4588c42fa8df0ea45ad48aca4511bb4286f0deaa41fdf188c3b7ab9e1b698a
SHA51201f270a15aa10e60e14ac140ccb54e38cf8e57833ef1c0db7d36688a93ecdc0a59ecf9ead9366a5920faac7e28a2e0ee03759eb0fa92d455abc72f406fe8775b
-
Filesize
2.5MB
MD562e5dbc52010c304c82ada0ac564eff9
SHA1d911cb02fdaf79e7c35b863699d21ee7a0514116
SHA256bd54ad7a25594dc823572d9b23a3490ff6b8b1742a75e368d110421ab08909b2
SHA512b5d863ea38816c18f7778ef12ea4168ceb0dae67704c0d1d4a60b0237ca6e758c1dfc5c28d4fc9679b0159de25e56d5dfff8addacd7a9c52572674d90c424946
-
Filesize
1KB
MD5f873c699ec012043f77d010d1afdf4d3
SHA10bb939611a1f8ea947b36c3fd7fa24c28b945194
SHA2565a27f0b4f20f2f25b188bfdd5d12e92a72fa33235036d32b5b6097ac362d21b7
SHA5124029adcd513a20c106418c0a25277be965661c26839bc2b20d4c2274f0044b84dc40dea94f1a5a24cb1c416ff379e82223a767fbe163d304e4c8196b33d680e0
-
Filesize
56B
MD519cf22e8d63e787913b6617542211e19
SHA18c3d2f43025e5c4ef70e0c4d1f36692361f51b1f
SHA256dbec312d736f8a56f94ace99986d95d4355ef644a2fd908da1ff4c8b0a003979
SHA5128b9d192dd7f175e63aebcdfc8426876fa8bf3ae00d3cf10bb8fcf0d0c262b906de28784f5b97141f656e87bb548d343b8d5a127c06ecb407289e91f3fc199608
-
Filesize
47B
MD55e578014c7017a85ca32f0b7e5d7df7f
SHA1c88d8e7179fcc070d4419be9f4d8647354c2f6ed
SHA256a964a717e3c47cb7d274e98928ca1271377d0d76a8908448e1b70e63af4082ad
SHA5127eb206b0cbc2a9b744246d8a83b2fccc70204c6e777b0fcbb838e63d477fe047d8827f3c0de823d55b9ab5cba2ab572ff3f543f76a3451fa81b31584cc767106
-
Filesize
43KB
MD5b2eca909a91e1946457a0b36eaf90930
SHA13200c4e4d0d4ece2b2aadb6939be59b91954bcfa
SHA2560b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c
SHA512607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf
-
Filesize
566KB
MD5c4aab3b24b159148d6d47a9e5897e593
SHA17061c2e85de9f3fd51cccdecb8965f1e710d1fe5
SHA25603a4d3563a7519542c662b5fd5d61215f3d76a3902717efe11230292ea4bbafc
SHA5129bc522ff0d598a1f1425a09a2794584c4991a99bc382b0ee9135311950cdbf2f5331ae041a4b01052735b5fae3a2763ea1b5c01ce679b07fba73c6f75cb4c252
-
Filesize
25KB
MD5aebe09cd7095ec201dc8acc350443242
SHA1df7337e051bd02e1fdd4005b63ed45b8ca3d9726
SHA256405d47dca73a5d6180db42e90c35931047c666ed1f1d6fab5ead6110c2356cc7
SHA512ffc658faf04fee47c1284d439a4c5b3931d2f9bcac9b40e36f59ad0ed4917f0252e639284f817ca84a6da57552f8e0fdf96936987c3f5cf689a537e42b47288d
-
Filesize
111KB
MD5e87a04c270f98bb6b5677cc789d1ad1d
SHA18c14cb338e23d4a82f6310d13b36729e543ff0ca
SHA256e03520794f00fb39ef3cfff012f72a5d03c60f89de28dbe69016f6ed151b5338
SHA5128784f4d42908e54ecedfb06b254992c63920f43a27903ccedd336daaeed346db44e1f40e7db971735da707b5b32206be1b1571bc0d6a2d6eb90bbf9d1f69de13
-
Filesize
578KB
MD5533d78fdd538bbeee31fb0b72a8cfb7c
SHA1cb0e46804e784525f5bece40d51772bbdd9a5dc4
SHA256b7a4fcc7f474c091edc09349af5e53915d23f14071d78a3026c92c49d2467989
SHA51285e393cbdd2b20da8892173c7951ddf8e75dbfa29cf81fa725a2da56e606b848ea8a6636528d4fe26eca5e6b251406ec870242fe0d44e7863bf22c739d7759d5
-
Filesize
5.0MB
MD5929335d847f8265c0a8648dd6d593605
SHA10ff9acf1293ed8b313628269791d09e6413fca56
SHA2566613acb18cb8bf501fba619f04f8298e5e633cb220c450212bbc9dd2bef9538d
SHA5127c9a4d1bec430503cc355dc76955d341e001b06196d4b508cc35d64feb2e8ba30e824e7c3a11c27135d7d99801f45f62a5b558563b4c78f89f5d156a929063fd
-
Filesize
467KB
MD5ab65e866abc51f841465d19aba35fb14
SHA1ec79f1f511a199291b0893bc866a788ceac19f6e
SHA2562ac0ca4ffda10b1861dd4ae0c2f0131a6400214cb4f5fa33951f3062b784a755
SHA5122474905f174635b236e5f6e8f8c497e44435c94edd02ec47d3440c9a216f6840d040e6acc5fe2ec301ada80467f6cf55225d6361c1e7c6c6c7edccb9e7b5a35e