warzonerat | cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6c

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
Size

8.2MB
MD5

ce8226da4d1e5d866924eab342e45120
SHA1

86971e55d9293a618e31b4552fa46cd537346a43
SHA256

cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6c
SHA512

fae7a0ffe54d7231d4316d67d3243333e0fa227a8d79697022bb774839444445d36e636369a7cb08b2423f7310909bcd9bf23410dd0749247838a93612aa2bce
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNeco:V8e8e8f8e8e8X

Score

10^/10

warzonerat aspackv2 discovery evasion infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c000000023b82-26.dat	warzonerat
behavioral2/files/0x000b000000023b80-45.dat	warzonerat
behavioral2/files/0x000f00000002369a-61.dat	warzonerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c000000023b82-26.dat	aspack_v212_v242
behavioral2/files/0x000b000000023b80-45.dat	aspack_v212_v242
behavioral2/files/0x000f00000002369a-61.dat	aspack_v212_v242

Executes dropped EXE 64 IoCs

pid	Process
1612	explorer.exe
2336	explorer.exe
2612	spoolsv.exe
884	spoolsv.exe
3544	spoolsv.exe
1996	spoolsv.exe
2192	spoolsv.exe
4164	spoolsv.exe
2428	spoolsv.exe
3968	spoolsv.exe
4308	spoolsv.exe
4128	spoolsv.exe
2680	spoolsv.exe
3124	spoolsv.exe
1544	spoolsv.exe
2000	spoolsv.exe
732	spoolsv.exe
4872	spoolsv.exe
1796	spoolsv.exe
4812	spoolsv.exe
3312	spoolsv.exe
3876	spoolsv.exe
1308	spoolsv.exe
4476	spoolsv.exe
1172	spoolsv.exe
1680	spoolsv.exe
2524	spoolsv.exe
740	spoolsv.exe
2104	spoolsv.exe
3656	spoolsv.exe
1728	spoolsv.exe
1768	spoolsv.exe
2040	spoolsv.exe
1684	spoolsv.exe
2144	spoolsv.exe
3824	spoolsv.exe
2396	spoolsv.exe
1524	spoolsv.exe
4304	spoolsv.exe
3168	spoolsv.exe
336	spoolsv.exe
1520	spoolsv.exe
4584	spoolsv.exe
3308	spoolsv.exe
4060	spoolsv.exe
1720	spoolsv.exe
2496	spoolsv.exe
3756	spoolsv.exe
4812	spoolsv.exe
4860	spoolsv.exe
5084	spoolsv.exe
2172	spoolsv.exe
3380	spoolsv.exe
2744	spoolsv.exe
552	spoolsv.exe
868	spoolsv.exe
3000	spoolsv.exe
232	spoolsv.exe
2448	spoolsv.exe
4640	spoolsv.exe
4112	spoolsv.exe
1432	spoolsv.exe
4312	spoolsv.exe
4164	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 set thread context of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 1612 set thread context of 2336	1612	explorer.exe	94
PID 1612 set thread context of 4404	1612	explorer.exe	95

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4064	884	WerFault.exe	97
4616	3544	WerFault.exe	101
1432	1996	WerFault.exe	104
548	2192	WerFault.exe	107
520	4164	WerFault.exe	110
3504	2428	WerFault.exe	113
3760	3968	WerFault.exe	116
2356	4308	WerFault.exe	119
544	4128	WerFault.exe	122
4248	2680	WerFault.exe	125
1008	3124	WerFault.exe	128
4868	1544	WerFault.exe	131
2704	2000	WerFault.exe	134
840	732	WerFault.exe	137
4752	4872	WerFault.exe	140
472	1796	WerFault.exe	143
4772	4812	WerFault.exe	146
4860	3312	WerFault.exe	149
4892	3876	WerFault.exe	152
4320	1308	WerFault.exe	155
2668	4476	WerFault.exe	158
32	1172	WerFault.exe	161
1676	1680	WerFault.exe	164
4376	2524	WerFault.exe	167
3332	740	WerFault.exe	170
5088	2104	WerFault.exe	173
3088	3656	WerFault.exe	176
1760	1728	WerFault.exe	179
2788	1768	WerFault.exe	182
3800	2040	WerFault.exe	185
2816	1684	WerFault.exe	188
4936	2144	WerFault.exe	191
836	3824	WerFault.exe	194
2428	2396	WerFault.exe	197
3968	1524	WerFault.exe	200
4984	4304	WerFault.exe	203
2476	3168	WerFault.exe	206
3408	336	WerFault.exe	209
4388	1520	WerFault.exe	212
4868	4584	WerFault.exe	215
3812	3308	WerFault.exe	218
1964	4060	WerFault.exe	221
3100	1720	WerFault.exe	224
2500	2496	WerFault.exe	227
5004	3756	WerFault.exe	230
3144	4812	WerFault.exe	233
4588	4860	WerFault.exe	236
956	5084	WerFault.exe	239
628	2172	WerFault.exe	242
3096	3380	WerFault.exe	245
4076	2744	WerFault.exe	248
3692	552	WerFault.exe	251
4424	868	WerFault.exe	254
3736	3000	WerFault.exe	257
2060	232	WerFault.exe	260
4636	2448	WerFault.exe	263
4900	4640	WerFault.exe	266
2896	4112	WerFault.exe	269
3140	1432	WerFault.exe	272
3840	4312	WerFault.exe	275
4456	4164	WerFault.exe	278
4140	3236	WerFault.exe	281
4352	3760	WerFault.exe	284
4632	1524	WerFault.exe	287

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe
2336	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 2388	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	91
PID 3416 wrote to memory of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 3416 wrote to memory of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 3416 wrote to memory of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 3416 wrote to memory of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 3416 wrote to memory of 4916	3416	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	92
PID 2388 wrote to memory of 1612	2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	93
PID 2388 wrote to memory of 1612	2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	93
PID 2388 wrote to memory of 1612	2388	cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe	93
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 2336	1612	explorer.exe	94
PID 1612 wrote to memory of 4404	1612	explorer.exe	95
PID 1612 wrote to memory of 4404	1612	explorer.exe	95
PID 1612 wrote to memory of 4404	1612	explorer.exe	95
PID 1612 wrote to memory of 4404	1612	explorer.exe	95
PID 1612 wrote to memory of 4404	1612	explorer.exe	95
PID 2336 wrote to memory of 2612	2336	explorer.exe	96
PID 2336 wrote to memory of 2612	2336	explorer.exe	96
PID 2336 wrote to memory of 2612	2336	explorer.exe	96
PID 2336 wrote to memory of 884	2336	explorer.exe	97
PID 2336 wrote to memory of 884	2336	explorer.exe	97
PID 2336 wrote to memory of 884	2336	explorer.exe	97
PID 2336 wrote to memory of 3544	2336	explorer.exe	101
PID 2336 wrote to memory of 3544	2336	explorer.exe	101
PID 2336 wrote to memory of 3544	2336	explorer.exe	101
PID 2336 wrote to memory of 1996	2336	explorer.exe	104
PID 2336 wrote to memory of 1996	2336	explorer.exe	104
PID 2336 wrote to memory of 1996	2336	explorer.exe	104
PID 2336 wrote to memory of 2192	2336	explorer.exe	107
PID 2336 wrote to memory of 2192	2336	explorer.exe	107
PID 2336 wrote to memory of 2192	2336	explorer.exe	107
PID 2336 wrote to memory of 4164	2336	explorer.exe	110
PID 2336 wrote to memory of 4164	2336	explorer.exe	110
PID 2336 wrote to memory of 4164	2336	explorer.exe	110
PID 2336 wrote to memory of 2428	2336	explorer.exe	113
PID 2336 wrote to memory of 2428	2336	explorer.exe	113
PID 2336 wrote to memory of 2428	2336	explorer.exe	113
PID 2336 wrote to memory of 3968	2336	explorer.exe	116
PID 2336 wrote to memory of 3968	2336	explorer.exe	116
PID 2336 wrote to memory of 3968	2336	explorer.exe	116
PID 2336 wrote to memory of 4308	2336	explorer.exe	119
PID 2336 wrote to memory of 4308	2336	explorer.exe	119
PID 2336 wrote to memory of 4308	2336	explorer.exe	119
PID 2336 wrote to memory of 4128	2336	explorer.exe	122
PID 2336 wrote to memory of 4128	2336	explorer.exe	122
PID 2336 wrote to memory of 4128	2336	explorer.exe	122
PID 2336 wrote to memory of 2680	2336	explorer.exe	125
PID 2336 wrote to memory of 2680	2336	explorer.exe	125
PID 2336 wrote to memory of 2680	2336	explorer.exe	125
PID 2336 wrote to memory of 3124	2336	explorer.exe	128
PID 2336 wrote to memory of 3124	2336	explorer.exe	128

C:\Users\Admin\AppData\Local\Temp\cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
"C:\Users\Admin\AppData\Local\Temp\cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe
  "C:\Users\Admin\AppData\Local\Temp\cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6cN.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2388
- - \??\c:\windows\system\explorer.exe
    c:\windows\system\explorer.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2336
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2612
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 192
        6⤵
        Program crash
        
        PID:4064
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 192
        6⤵
        Program crash
        
        PID:4616
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 192
        6⤵
        Program crash
        
        PID:1432
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 192
        6⤵
        Program crash
        
        PID:548
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 192
        6⤵
        Program crash
        
        PID:520
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2428
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 192
        6⤵
        Program crash
        
        PID:3504
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 192
        6⤵
        Program crash
        
        PID:3760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 192
        6⤵
        Program crash
        
        PID:2356
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 192
        6⤵
        Program crash
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 192
        6⤵
        Program crash
        
        PID:4248
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 192
        6⤵
        Program crash
        
        PID:1008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 192
        6⤵
        Program crash
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 192
        6⤵
        Program crash
        
        PID:2704
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:732
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 192
        6⤵
        Program crash
        
        PID:840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 192
        6⤵
        Program crash
        
        PID:4752
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 192
        6⤵
        Program crash
        
        PID:472
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 192
        6⤵
        Program crash
        
        PID:4772
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 192
        6⤵
        Program crash
        
        PID:4860
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 192
        6⤵
        Program crash
        
        PID:4892
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 192
        6⤵
        Program crash
        
        PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 192
        6⤵
        Program crash
        
        PID:2668
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 192
        6⤵
        Program crash
        
        PID:32
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 192
        6⤵
        Program crash
        
        PID:1676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 192
        6⤵
        Program crash
        
        PID:4376
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 192
        6⤵
        Program crash
        
        PID:3332
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2104
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 192
        6⤵
        Program crash
        
        PID:5088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3656
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 200
        6⤵
        Program crash
        
        PID:3088
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 192
        6⤵
        Program crash
        
        PID:1760
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 192
        6⤵
        Program crash
        
        PID:2788
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 192
        6⤵
        Program crash
        
        PID:3800
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1684
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 192
        6⤵
        Program crash
        
        PID:2816
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 192
        6⤵
        Program crash
        
        PID:4936
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3824
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 192
        6⤵
        Program crash
        
        PID:836
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 192
        6⤵
        Program crash
        
        PID:2428
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 192
        6⤵
        Program crash
        
        PID:3968
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 192
        6⤵
        Program crash
        
        PID:4984
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 192
        6⤵
        Program crash
        
        PID:2476
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 192
        6⤵
        Program crash
        
        PID:3408
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 192
        6⤵
        Program crash
        
        PID:4388
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 192
        6⤵
        Program crash
        
        PID:4868
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3308
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 192
        6⤵
        Program crash
        
        PID:3812
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 192
        6⤵
        Program crash
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1720
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 192
        6⤵
        Program crash
        
        PID:3100
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 192
        6⤵
        Program crash
        
        PID:2500
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 192
        6⤵
        Program crash
        
        PID:5004
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 192
        6⤵
        Program crash
        
        PID:3144
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 192
        6⤵
        Program crash
        
        PID:4588
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:5084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 192
        6⤵
        Program crash
        
        PID:956
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2172
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 192
        6⤵
        Program crash
        
        PID:628
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 192
        6⤵
        Program crash
        
        PID:3096
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2744
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 192
        6⤵
        Program crash
        
        PID:4076
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 192
        6⤵
        Program crash
        
        PID:3692
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:868
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 192
        6⤵
        Program crash
        
        PID:4424
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:3000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 192
        6⤵
        Program crash
        
        PID:3736
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:232
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 192
        6⤵
        Program crash
        
        PID:2060
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 192
        6⤵
        Program crash
        
        PID:4636
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 192
        6⤵
        Program crash
        
        PID:4900
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4112
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 192
        6⤵
        Program crash
        
        PID:2896
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:1432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 192
        6⤵
        Program crash
        
        PID:3140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 192
        6⤵
        Program crash
        
        PID:3840
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        Executes dropped EXE
        
        PID:4164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 192
        6⤵
        Program crash
        
        PID:4456
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 192
        6⤵
        Program crash
        
        PID:4140
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 192
        6⤵
        Program crash
        
        PID:4352
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 192
        6⤵
        Program crash
        
        PID:4632
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 192
        6⤵
        
        PID:544
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:4832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 192
        6⤵
        
        PID:5008
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:1500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 192
        6⤵
        
        PID:4464
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:2012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 192
        6⤵
        
        PID:3676
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:440
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 192
        6⤵
        
        PID:4120
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 192
        6⤵
        
        PID:3828
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 192
        6⤵
        
        PID:1964
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe SE
        5⤵
        
        PID:3248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 192
        6⤵
        
        PID:4872
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\SysWOW64\diskperf.exe"
      4⤵
      PID:4404
- C:\Windows\SysWOW64\diskperf.exe
  "C:\Windows\SysWOW64\diskperf.exe"
  2⤵
  PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 884 -ip 884
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3544 -ip 3544
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1996 -ip 1996
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2192 -ip 2192
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4164 -ip 4164
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2428 -ip 2428
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3968 -ip 3968
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4308 -ip 4308
1⤵
PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4128 -ip 4128
1⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2680 -ip 2680
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3124 -ip 3124
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1544 -ip 1544
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2000 -ip 2000
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 732 -ip 732
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4872 -ip 4872
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1796 -ip 1796
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4812 -ip 4812
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3312 -ip 3312
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3876 -ip 3876
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1308 -ip 1308
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4476 -ip 4476
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1172 -ip 1172
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1680 -ip 1680
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2524 -ip 2524
1⤵
PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 740 -ip 740
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2104 -ip 2104
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3656 -ip 3656
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1728 -ip 1728
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1768 -ip 1768
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2040 -ip 2040
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1684 -ip 1684
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2144 -ip 2144
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3824 -ip 3824
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2396 -ip 2396
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1524 -ip 1524
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4304 -ip 4304
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3168 -ip 3168
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 336 -ip 336
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1520 -ip 1520
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4584 -ip 4584
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3308 -ip 3308
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4060 -ip 4060
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1720 -ip 1720
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2496 -ip 2496
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3756 -ip 3756
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4812 -ip 4812
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4860 -ip 4860
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5084 -ip 5084
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2172 -ip 2172
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3380 -ip 3380
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2744 -ip 2744
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 552 -ip 552
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 868 -ip 868
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3000 -ip 3000
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 232 -ip 232
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2448 -ip 2448
1⤵
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4640 -ip 4640
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4112 -ip 4112
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1432 -ip 1432
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4312 -ip 4312
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4164 -ip 4164
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3236 -ip 3236
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3760 -ip 3760
1⤵
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1524 -ip 1524
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4304 -ip 4304
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4832 -ip 4832
1⤵
PID:3920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1500 -ip 1500
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2012 -ip 2012
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 440 -ip 440
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3632 -ip 3632
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3924 -ip 3924
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3248 -ip 3248
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

Filesize
8.2MB

MD5
ce8226da4d1e5d866924eab342e45120

SHA1
86971e55d9293a618e31b4552fa46cd537346a43

SHA256
cc8b97603d4ccd166d13d38d70ed607c127b53318e849e17f58032de04269c6c

SHA512
fae7a0ffe54d7231d4316d67d3243333e0fa227a8d79697022bb774839444445d36e636369a7cb08b2423f7310909bcd9bf23410dd0749247838a93612aa2bce

Download Submit
C:\Windows\System\explorer.exe

Filesize
8.2MB

MD5
c13efa9bd9d74365544eed9045531507

SHA1
3920bc523150637999659116c940ce447408c274

SHA256
72fcdc68e946d704984a908dae2ab7463f7532bdfd2bf374429dd68a9a3ba72a

SHA512
fcf7bc55f21f80c520b096efee0b71e4c932e17a6a61ba3611ccf44541d29c1333020928da3c1fb0284a273b0b4092123a89e63db373c1b1697867e50747c2ec

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
8.2MB

MD5
1bce2ac7e648cbadb5648c174d0d47b4

SHA1
5e98e777cc71b5177296f5dc202ae7c6c7a1fbda

SHA256
d40fb82c3dba69c098215bf8e62bb934e85d4d64560871ad8e44ef133088184c

SHA512
32a0a9b9d588ef9f0bc3d2d8262673bfecac8fa156209132460396ebb4fcef05809450cb8884c1c4e713720cae002852e4528d44ae0cda3a6fe3745d2b4fccff

Download Submit
memory/336-117-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/884-69-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/884-68-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-57-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-31-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-34-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-32-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1612-30-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/1796-91-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2336-47-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2336-76-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2388-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2388-33-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2388-10-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2428-77-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2612-63-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2612-82-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2612-64-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/2680-83-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3312-94-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3416-6-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3416-3-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/3416-2-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3416-1-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3416-0-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3416-4-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3416-23-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/3544-71-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4312-139-0x0000000000400000-0x0000000000514000-memory.dmp

Filesize
1.1MB

Download
memory/4404-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4916-19-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4916-17-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4916-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download