xtremerat | b28959bf7057d383edf738fe3a91aafd6d801b968a9f95d4ce9c6eb966be0ffd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Size

31KB
MD5

bb78fc2e4428fd2d6294c258b90dc6d4
SHA1

187e6150cb3eadc24bf8fec5a302b21a2b42a5b0
SHA256

b28959bf7057d383edf738fe3a91aafd6d801b968a9f95d4ce9c6eb966be0ffd
SHA512

35e0b0c8c8a2a9e15dccddb2e502fd792af82857f88ccbc4b10cf994094571e2f4911a27f6cc25de94178f2e3a270d361880ae2fb96412f0fdeae1404209fd40
SSDEEP

768:rqX5npcxOhH6GzZSEjsLMIL/nriE7W5GTx6bPrxh:eX5nqOtlzcsnILO+W5PN

Score

10^/10

xtremerat aspackv2 discovery persistence rat spyware

Malware Config

Extracted

Family

xtremerat

helwan1.no-ip.info

Signatures

Detect XtremeRAT payload 33 IoCs

resource	yara_rule
behavioral2/memory/1912-2-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1740-6-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1912-11-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2220-13-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2220-20-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4844-24-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4844-32-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4284-38-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4284-43-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1868-47-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1868-53-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2684-57-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2684-62-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4616-66-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4616-73-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1780-77-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1780-83-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2576-91-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2576-97-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3900-104-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3900-110-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3652-117-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3652-123-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3652-122-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3992-130-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3992-137-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/624-151-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1152-157-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/1152-164-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3988-177-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/2556-191-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/4236-204-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat
behavioral2/memory/3472-217-0x0000000000C80000-0x0000000000C99000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Boot or Logon Autostart Execution: Active Setup 2 TTPs 38 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\1111.exe restart"	1111.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}	1111.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a000000023beb-7.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1111.exe

Executes dropped EXE 46 IoCs

pid	Process
2220	1111.exe
3804	1111.exe
4844	1111.exe
3232	1111.exe
3564	1111.exe
4284	1111.exe
2888	1111.exe
1868	1111.exe
5056	1111.exe
2684	1111.exe
3624	1111.exe
4616	1111.exe
3304	1111.exe
1780	1111.exe
1440	1111.exe
3588	1111.exe
2576	1111.exe
4708	1111.exe
3888	1111.exe
3900	1111.exe
764	1111.exe
4508	1111.exe
3652	1111.exe
392	1111.exe
3636	1111.exe
3992	1111.exe
3248	1111.exe
1276	1111.exe
624	1111.exe
1604	1111.exe
4416	1111.exe
1152	1111.exe
4840	1111.exe
3888	1111.exe
3988	1111.exe
336	1111.exe
388	1111.exe
2556	1111.exe
4936	1111.exe
4976	1111.exe
4236	1111.exe
2744	1111.exe
1868	1111.exe
3472	1111.exe
2932	1111.exe
3060	1111.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\1111.exe"	1111.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\InstallDir\1111.exe	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
File created	C:\Windows\InstallDir\1111.exe	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 47 IoCs

pid	pid_target	Process	procid_target
3916	1912	WerFault.exe	82
2864	2220	WerFault.exe	95
2892	3804	WerFault.exe	112
1976	4844	WerFault.exe	115
4360	3232	WerFault.exe
4176	3564	WerFault.exe	131
216	4284	WerFault.exe
3916	2888	WerFault.exe
2696	1868	WerFault.exe	152
3372	5056	WerFault.exe
3356	2684	WerFault.exe	168
5092	3624	WerFault.exe
3556	4616	WerFault.exe
2132	3304	WerFault.exe	193
2196	1780	WerFault.exe	197
4224	1440	WerFault.exe	208
3160	3588	WerFault.exe	210
2248	2576	WerFault.exe	214
5004	4708	WerFault.exe	225
3616	3888	WerFault.exe	227
5008	3900	WerFault.exe	232
5080	764	WerFault.exe	243
812	4508	WerFault.exe	245
1100	3652	WerFault.exe	249
3048	392	WerFault.exe	260
3084	3636	WerFault.exe	262
4140	3992	WerFault.exe	266
2016	3248	WerFault.exe	277
1032	1276	WerFault.exe	279
5080	624	WerFault.exe	283
4748	1604	WerFault.exe	294
2248	4416	WerFault.exe	295
824	1152	WerFault.exe	300
3816	4840	WerFault.exe	311
2632	3888	WerFault.exe	313
2044	3988	WerFault.exe	317
2760	336	WerFault.exe	328
624	388	WerFault.exe	331
1504	2556	WerFault.exe	334
3816	4976	WerFault.exe	346
876	4936	WerFault.exe	345
1988	4236	WerFault.exe	351
2564	2744	WerFault.exe	362
2168	1868	WerFault.exe	364
3636	3472	WerFault.exe	368
1720	2932	WerFault.exe	379
3808	3060	WerFault.exe	381

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1111.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 1740	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	86
PID 1912 wrote to memory of 1740	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	86
PID 1912 wrote to memory of 1740	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	86
PID 1912 wrote to memory of 1740	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	86
PID 1912 wrote to memory of 772	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	87
PID 1912 wrote to memory of 772	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	87
PID 1912 wrote to memory of 772	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	87
PID 1912 wrote to memory of 3592	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	88
PID 1912 wrote to memory of 3592	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	88
PID 1912 wrote to memory of 3592	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	88
PID 1912 wrote to memory of 3604	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	89
PID 1912 wrote to memory of 3604	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	89
PID 1912 wrote to memory of 3604	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	89
PID 1912 wrote to memory of 4864	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	90
PID 1912 wrote to memory of 4864	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	90
PID 1912 wrote to memory of 4864	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	90
PID 1912 wrote to memory of 5044	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	91
PID 1912 wrote to memory of 5044	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	91
PID 1912 wrote to memory of 5044	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	91
PID 1912 wrote to memory of 3392	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	92
PID 1912 wrote to memory of 3392	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	92
PID 1912 wrote to memory of 3392	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	92
PID 1912 wrote to memory of 4900	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	93
PID 1912 wrote to memory of 4900	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	93
PID 1912 wrote to memory of 4900	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	93
PID 1912 wrote to memory of 4808	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	94
PID 1912 wrote to memory of 4808	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	94
PID 1912 wrote to memory of 2220	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	95
PID 1912 wrote to memory of 2220	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	95
PID 1912 wrote to memory of 2220	1912	bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe	95
PID 2220 wrote to memory of 1468	2220	1111.exe	98
PID 2220 wrote to memory of 1468	2220	1111.exe	98
PID 2220 wrote to memory of 1468	2220	1111.exe	98
PID 2220 wrote to memory of 3820	2220	1111.exe	99
PID 2220 wrote to memory of 3820	2220	1111.exe	99
PID 2220 wrote to memory of 3820	2220	1111.exe	99
PID 2220 wrote to memory of 3704	2220	1111.exe	100
PID 2220 wrote to memory of 3704	2220	1111.exe	100
PID 2220 wrote to memory of 3704	2220	1111.exe	100
PID 2220 wrote to memory of 400	2220	1111.exe	101
PID 2220 wrote to memory of 400	2220	1111.exe	101
PID 2220 wrote to memory of 400	2220	1111.exe	101
PID 2220 wrote to memory of 4340	2220	1111.exe	102
PID 2220 wrote to memory of 4340	2220	1111.exe	102
PID 2220 wrote to memory of 4340	2220	1111.exe	102
PID 2220 wrote to memory of 1052	2220	1111.exe	103
PID 2220 wrote to memory of 1052	2220	1111.exe	103
PID 2220 wrote to memory of 1052	2220	1111.exe	103
PID 2220 wrote to memory of 4244	2220	1111.exe	106
PID 2220 wrote to memory of 4244	2220	1111.exe	106
PID 2220 wrote to memory of 4244	2220	1111.exe	106
PID 2220 wrote to memory of 4640	2220	1111.exe	109
PID 2220 wrote to memory of 4640	2220	1111.exe	109
PID 2220 wrote to memory of 3804	2220	1111.exe	112
PID 2220 wrote to memory of 3804	2220	1111.exe	112
PID 2220 wrote to memory of 3804	2220	1111.exe	112
PID 1740 wrote to memory of 4844	1740	svchost.exe	115
PID 1740 wrote to memory of 4844	1740	svchost.exe	115
PID 1740 wrote to memory of 4844	1740	svchost.exe	115
PID 4844 wrote to memory of 3420	4844	1111.exe	118
PID 4844 wrote to memory of 3420	4844	1111.exe	118
PID 4844 wrote to memory of 3420	4844	1111.exe	118
PID 4844 wrote to memory of 3980	4844	1111.exe	119
PID 4844 wrote to memory of 3980	4844	1111.exe	119

C:\Users\Admin\AppData\Local\Temp\bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 496
  2⤵
  - Program crash
  PID:3916
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 476
      4⤵
      Program crash
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1140
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:3564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 468
        5⤵
        Program crash
        
        PID:4176
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 480
      4⤵
      Program crash
      PID:4360
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 480
      4⤵
      Program crash
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4524
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:2888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 476
        5⤵
        Program crash
        
        PID:3916
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 480
      4⤵
      Program crash
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4460
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:5056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 480
        5⤵
        Program crash
        
        PID:3372
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 464
      4⤵
      Program crash
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2072
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:3624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 468
        5⤵
        Program crash
        
        PID:5092
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 464
      4⤵
      Program crash
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4776
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:3304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 468
        5⤵
        Program crash
        
        PID:2132
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 464
      4⤵
      Program crash
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4804
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:1440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 468
        5⤵
        Program crash
        
        PID:4224
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 468
      4⤵
      Program crash
      PID:3160
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 484
      4⤵
      Program crash
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1536
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:4708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 468
        5⤵
        Program crash
        
        PID:5004
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 468
      4⤵
      Program crash
      PID:3616
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 468
      4⤵
      Program crash
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3240
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 468
        5⤵
        Program crash
        
        PID:5080
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:4508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 472
      4⤵
      Program crash
      PID:812
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 472
      4⤵
      Program crash
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4128
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 480
        5⤵
        Program crash
        
        PID:3048
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 472
      4⤵
      Program crash
      PID:3084
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 476
      4⤵
      Program crash
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4424
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:3248
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 468
        5⤵
        Program crash
        
        PID:2016
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:1276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 468
      4⤵
      Program crash
      PID:1032
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 464
      4⤵
      Program crash
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1156
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:1604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 468
        5⤵
        Program crash
        
        PID:4748
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 480
      4⤵
      Program crash
      PID:2248
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 472
      4⤵
      Program crash
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2192
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 468
        5⤵
        Program crash
        
        PID:3816
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 468
      4⤵
      Program crash
      PID:2632
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 464
      4⤵
      Program crash
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:864
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 480
        5⤵
        Program crash
        
        PID:2760
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 476
      4⤵
      Program crash
      PID:624
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 476
      4⤵
      Program crash
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1588
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:4936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 468
        5⤵
        Program crash
        
        PID:876
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 476
      4⤵
      Program crash
      PID:3816
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 480
      4⤵
      Program crash
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:784
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:2744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 468
        5⤵
        Program crash
        
        PID:2564
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 468
      4⤵
      Program crash
      PID:2168
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 476
      4⤵
      Program crash
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1936
  - - C:\Windows\InstallDir\1111.exe
      "C:\Windows\InstallDir\1111.exe"
      4⤵
      Executes dropped EXE
      PID:2932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 480
        5⤵
        Program crash
        
        PID:1720
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 468
      4⤵
      Program crash
      PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4808
- C:\Windows\InstallDir\1111.exe
  "C:\Windows\InstallDir\1111.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 508
    3⤵
    - Program crash
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4640
- - C:\Windows\InstallDir\1111.exe
    "C:\Windows\InstallDir\1111.exe"
    3⤵
    - Executes dropped EXE
    PID:3804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 468
      4⤵
      Program crash
      PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1912 -ip 1912
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2220 -ip 2220
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3804 -ip 3804
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4844 -ip 4844
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3232 -ip 3232
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3564 -ip 3564
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4284 -ip 4284
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2888 -ip 2888
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1868 -ip 1868
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5056 -ip 5056
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2684 -ip 2684
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3624 -ip 3624
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4616 -ip 4616
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3304 -ip 3304
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1780 -ip 1780
1⤵
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1440 -ip 1440
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3588 -ip 3588
1⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2576 -ip 2576
1⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4708 -ip 4708
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3888 -ip 3888
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3900 -ip 3900
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 764 -ip 764
1⤵
PID:228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4508 -ip 4508
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3652 -ip 3652
1⤵
PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 392 -ip 392
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3636 -ip 3636
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3992 -ip 3992
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3248 -ip 3248
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1276 -ip 1276
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 624 -ip 624
1⤵
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1604 -ip 1604
1⤵
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4416 -ip 4416
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1152 -ip 1152
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4840 -ip 4840
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3888 -ip 3888
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3988 -ip 3988
1⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 336 -ip 336
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 388 -ip 388
1⤵
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2556 -ip 2556
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4936 -ip 4936
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4976 -ip 4976
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4236 -ip 4236
1⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2744 -ip 2744
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1868 -ip 1868
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3472 -ip 3472
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2932 -ip 2932
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3060 -ip 3060
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfg

Filesize
1KB

MD5
2667f246fba2115aff5e4f126f1a3f20

SHA1
65e0b63f9816699383042977c73fac075d33e9bc

SHA256
89d4eb464b4d0ca8eabbc1b1e04da1180603c6909aa94a9c0bd6f0a5e7dd38e1

SHA512
e653d57ceeb36f3f10fc91cb0dbe93ddaa0f9f90030abca37b2db5108923e418ad3211bb95b82fc3982a80c539ef96c8fddcf90b6cdcd58e97c59029bc5f6b9a

Download Submit
C:\Windows\InstallDir\1111.exe

Filesize
31KB

MD5
bb78fc2e4428fd2d6294c258b90dc6d4

SHA1
187e6150cb3eadc24bf8fec5a302b21a2b42a5b0

SHA256
b28959bf7057d383edf738fe3a91aafd6d801b968a9f95d4ce9c6eb966be0ffd

SHA512
35e0b0c8c8a2a9e15dccddb2e502fd792af82857f88ccbc4b10cf994094571e2f4911a27f6cc25de94178f2e3a270d361880ae2fb96412f0fdeae1404209fd40

Download Submit
memory/336-180-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/388-182-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/392-126-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/624-151-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1152-157-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1152-156-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1152-164-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1276-139-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1740-6-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1780-76-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1780-77-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1780-83-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1868-208-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1868-47-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1868-53-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1868-46-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1912-0-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1912-11-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1912-2-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/1912-1-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2220-12-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2220-20-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2220-13-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2220-9-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2556-191-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2576-91-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2576-90-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2576-97-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2684-62-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2684-56-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2684-57-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/2888-44-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3060-219-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3232-34-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3248-135-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3248-141-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3304-71-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3472-217-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3564-30-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3588-85-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3588-88-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3624-63-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3636-127-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3652-123-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3652-122-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3652-116-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3652-117-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3804-18-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3804-21-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3888-168-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3888-99-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3900-110-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3900-104-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3900-103-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3988-177-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3992-130-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3992-129-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/3992-137-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4236-204-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4284-43-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4284-38-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4284-37-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4416-154-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4508-112-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4508-114-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4616-65-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4616-66-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4616-73-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4708-101-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4840-162-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4844-32-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4844-24-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4844-23-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/4936-194-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download
memory/5056-54-0x0000000000C80000-0x0000000000C99000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads