gh0strat | e78c06600581328649e63ba09b8d8984c2c9393d656c598fd4bdf14e045e0b37

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe
Size 792KB
Sample260701-jtvj1abx21
SHA256 e78c06600581328649e63ba09b8d8984c2c9393d656c598fd4bdf14e045e0b37
MD5 b0e7bfba3beea28026911d1333dc4560
SHA1 a85e8ba59d883b7f5fa831b96d098fb12c313083
SHA512 b6eb2dc1068c5d1662c21cafebb6eb683ec7d1a2bde2d09dbc696840a15b8bca7d0946b094808df27de84c59d06479b9ea2878f6576dd026ea19c78e04eb7438
SSDEEP 12288:cThR2oreHPuKNajprUkz0+NsqJnWNaYXkHihBq8BUn4ztqI5rXhVIqn:IKmKNUHI+NsqwYYX/LLBg48I5rRVr
TLSH
T15505D0D2F3D5195AD6AC363D2748859E4CF2FEB595C25C88336D43BC0A0875AACCFA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat xmrig miner rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/2696-0-0x0000000010000000-0x00000000100C9000-memory.dmp	family_gh0strat
behavioral2/memory/2348-5-0x0000000010000000-0x00000000100C9000-memory.dmp	family_gh0strat

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/2696-0-0x0000000010000000-0x00000000100C9000-memory.dmp	xmrig
behavioral2/memory/2348-5-0x0000000010000000-0x00000000100C9000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
4724	WScript.exe

Executes dropped EXE 64 IoCs

pid	Process
2348	svchost.exe
7096	svchost.exe
3884	svchost.exe
2576	svchost.exe
6788	svchost.exe
1500	svchost.exe
1048	svchost.exe
6836	svchost.exe
5056	svchost.exe
5904	svchost.exe
5364	svchost.exe
4980	svchost.exe
5092	svchost.exe
4452	svchost.exe
6772	svchost.exe
4672	svchost.exe
7060	svchost.exe
4064	svchost.exe
5772	svchost.exe
6944	svchost.exe
4812	svchost.exe
2744	svchost.exe
1644	svchost.exe
6196	svchost.exe
6952	svchost.exe
5712	svchost.exe
4656	svchost.exe
1648	svchost.exe
1172	svchost.exe
3060	svchost.exe
3940	svchost.exe
6128	svchost.exe
6876	svchost.exe
108	svchost.exe
6852	svchost.exe
1720	svchost.exe
5620	svchost.exe
4804	svchost.exe
6352	svchost.exe
1064	svchost.exe
1092	svchost.exe
3504	svchost.exe
3444	svchost.exe
6464	svchost.exe
4504	svchost.exe
7064	svchost.exe
2636	svchost.exe
2964	svchost.exe
1188	svchost.exe
5652	svchost.exe
4384	svchost.exe
5704	svchost.exe
6248	svchost.exe
1068	svchost.exe
5240	svchost.exe
2436	svchost.exe
5984	svchost.exe
916	svchost.exe
5480	svchost.exe
6184	svchost.exe
4540	svchost.exe
7112	svchost.exe
7076	svchost.exe
4392	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2180	2348	WerFault.exe	89
6780	2576	WerFault.exe	96
5108	1048	WerFault.exe	101
2944	5904	WerFault.exe	106
2084	5092	WerFault.exe	111
1344	4672	WerFault.exe	116
4820	5772	WerFault.exe	121
6660	2744	WerFault.exe	126
4336	6952	WerFault.exe	131
3460	1648	WerFault.exe	136
3204	3940	WerFault.exe	141
4576	108	WerFault.exe	146
3432	5620	WerFault.exe	151
1152	1064	WerFault.exe	156
6652	3444	WerFault.exe	161
6200	7064	WerFault.exe	167
6340	1188	WerFault.exe	172
6108	5704	WerFault.exe	177
6204	5240	WerFault.exe	182
6868	916	WerFault.exe	187
4244	4540	WerFault.exe	192
6788	4392	WerFault.exe	197
1432	5436	WerFault.exe	202
5056	1940	WerFault.exe	207
5516	1824	WerFault.exe	212
1584	3260	WerFault.exe	217
3708	3364	WerFault.exe	222
5380	4532	WerFault.exe	227
672	2888	WerFault.exe	232
432	1768	WerFault.exe	237
1248	6804	WerFault.exe	242
4120	4092	WerFault.exe	247
1720	6724	WerFault.exe	252
6820	3692	WerFault.exe	257
6208	5476	WerFault.exe	262
2948	5424	WerFault.exe	267
4920	2392	WerFault.exe	272
4088	2140	WerFault.exe	277
5752	1844	WerFault.exe	282
6000	5744	WerFault.exe	287
6400	4764	WerFault.exe	292
3844	7144	WerFault.exe	297
2272	2732	WerFault.exe	302
4984	1308	WerFault.exe	307
6036	6392	WerFault.exe	312
5728	6220	WerFault.exe	317
5988	1904	WerFault.exe	322
1800	6528	WerFault.exe	327
6132	7052	WerFault.exe	332
1136	1216	WerFault.exe	337
3176	1032	WerFault.exe	342
704	1556	WerFault.exe	347
4496	6620	WerFault.exe	352
2128	1720	WerFault.exe	357
5440	5700	WerFault.exe	362
1764	5064	WerFault.exe	367
2164	6900	WerFault.exe	372
5020	6968	WerFault.exe	377
2780	6484	WerFault.exe	382
4376	2684	WerFault.exe	387
5876	6432	WerFault.exe	392
2032	2180	WerFault.exe	397
4260	1128	WerFault.exe	402
3312	2852	WerFault.exe	407

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000_Classes\Local Settings	2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4724	2696	2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe	90
PID 2348 wrote to memory of 7096	2348	svchost.exe	91
PID 2348 wrote to memory of 3884	2348	svchost.exe	92
PID 2576 wrote to memory of 6788	2576	svchost.exe	97
PID 2576 wrote to memory of 1500	2576	svchost.exe	98
PID 1048 wrote to memory of 6836	1048	svchost.exe	102
PID 1048 wrote to memory of 5056	1048	svchost.exe	103
PID 5904 wrote to memory of 5364	5904	svchost.exe	107
PID 5904 wrote to memory of 4980	5904	svchost.exe	108
PID 5092 wrote to memory of 4452	5092	svchost.exe	112
PID 5092 wrote to memory of 6772	5092	svchost.exe	113
PID 4672 wrote to memory of 7060	4672	svchost.exe	117
PID 4672 wrote to memory of 4064	4672	svchost.exe	118
PID 5772 wrote to memory of 6944	5772	svchost.exe	122
PID 5772 wrote to memory of 4812	5772	svchost.exe	123
PID 2744 wrote to memory of 1644	2744	svchost.exe	127
PID 2744 wrote to memory of 6196	2744	svchost.exe	128
PID 6952 wrote to memory of 5712	6952	svchost.exe	132
PID 6952 wrote to memory of 4656	6952	svchost.exe	133
PID 1648 wrote to memory of 1172	1648	svchost.exe	137
PID 1648 wrote to memory of 3060	1648	svchost.exe	138
PID 3940 wrote to memory of 6128	3940	svchost.exe	142
PID 3940 wrote to memory of 6876	3940	svchost.exe	143
PID 108 wrote to memory of 6852	108	svchost.exe	147
PID 108 wrote to memory of 1720	108	svchost.exe	148
PID 5620 wrote to memory of 4804	5620	svchost.exe	152
PID 5620 wrote to memory of 6352	5620	svchost.exe	153
PID 1064 wrote to memory of 1092	1064	svchost.exe	157
PID 1064 wrote to memory of 3504	1064	svchost.exe	158
PID 3444 wrote to memory of 6464	3444	svchost.exe	162
PID 3444 wrote to memory of 4504	3444	svchost.exe	164
PID 7064 wrote to memory of 2636	7064	svchost.exe	168
PID 7064 wrote to memory of 2964	7064	svchost.exe	169
PID 1188 wrote to memory of 5652	1188	svchost.exe	173
PID 1188 wrote to memory of 4384	1188	svchost.exe	174
PID 5704 wrote to memory of 6248	5704	svchost.exe	178
PID 5704 wrote to memory of 1068	5704	svchost.exe	179
PID 5240 wrote to memory of 2436	5240	svchost.exe	183
PID 5240 wrote to memory of 5984	5240	svchost.exe	184
PID 916 wrote to memory of 5480	916	svchost.exe	188
PID 916 wrote to memory of 6184	916	svchost.exe	189
PID 4540 wrote to memory of 7112	4540	svchost.exe	193
PID 4540 wrote to memory of 7076	4540	svchost.exe	194
PID 4392 wrote to memory of 1104	4392	svchost.exe	198
PID 4392 wrote to memory of 4184	4392	svchost.exe	199
PID 5436 wrote to memory of 3312	5436	svchost.exe	203
PID 5436 wrote to memory of 2608	5436	svchost.exe	204
PID 1940 wrote to memory of 1408	1940	svchost.exe	208
PID 1940 wrote to memory of 5296	1940	svchost.exe	209
PID 1824 wrote to memory of 3968	1824	svchost.exe	213
PID 1824 wrote to memory of 5728	1824	svchost.exe	214
PID 3260 wrote to memory of 1224	3260	svchost.exe	218
PID 3260 wrote to memory of 6156	3260	svchost.exe	219
PID 3364 wrote to memory of 1752	3364	svchost.exe	223
PID 3364 wrote to memory of 5012	3364	svchost.exe	224
PID 4532 wrote to memory of 7004	4532	svchost.exe	228
PID 4532 wrote to memory of 4400	4532	svchost.exe	229
PID 2888 wrote to memory of 3076	2888	svchost.exe	233
PID 2888 wrote to memory of 4896	2888	svchost.exe	234
PID 1768 wrote to memory of 6436	1768	svchost.exe	238
PID 1768 wrote to memory of 2380	1768	svchost.exe	239
PID 6804 wrote to memory of 7032	6804	svchost.exe	243
PID 6804 wrote to memory of 5628	6804	svchost.exe	244
PID 4092 wrote to memory of 1240	4092	svchost.exe	248

C:\Users\Admin\AppData\Local\Temp\2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_b0e7bfba3beea28026911d1333dc4560_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\4272.vbs"
  2⤵
  - Deletes itself
  PID:4724

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7096
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 696
  2⤵
  - Program crash
  PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2348 -ip 2348
1⤵
PID:5480

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6788
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 664
  2⤵
  - Program crash
  PID:6780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2576 -ip 2576
1⤵
PID:1816

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6836
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 664
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1048 -ip 1048
1⤵
PID:1712

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 632
  2⤵
  - Program crash
  PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5904 -ip 5904
1⤵
PID:1300

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 664
  2⤵
  - Program crash
  PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5092 -ip 5092
1⤵
PID:6764

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:7060
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 664
  2⤵
  - Program crash
  PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4672 -ip 4672
1⤵
PID:2028

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6944
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 632
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 5772 -ip 5772
1⤵
PID:4536

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 648
  2⤵
  - Program crash
  PID:6660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2744 -ip 2744
1⤵
PID:6656

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6952
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6952 -s 632
  2⤵
  - Program crash
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6952 -ip 6952
1⤵
PID:4600

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 664
  2⤵
  - Program crash
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1648 -ip 1648
1⤵
PID:3804

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6128
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 632
  2⤵
  - Program crash
  PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3940 -ip 3940
1⤵
PID:1980

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6852
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 632
  2⤵
  - Program crash
  PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 108 -ip 108
1⤵
PID:1680

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 668
  2⤵
  - Program crash
  PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5620 -ip 5620
1⤵
PID:2100

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 632
  2⤵
  - Program crash
  PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1064 -ip 1064
1⤵
PID:4308

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6464
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 664
  2⤵
  - Program crash
  PID:6652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3444 -ip 3444
1⤵
PID:3688

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7064
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7064 -s 632
  2⤵
  - Program crash
  PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 7064 -ip 7064
1⤵
PID:3732

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5652
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 692
  2⤵
  - Program crash
  PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1188 -ip 1188
1⤵
PID:4424

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6248
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 632
  2⤵
  - Program crash
  PID:6108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5704 -ip 5704
1⤵
PID:5768

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 672
  2⤵
  - Program crash
  PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5240 -ip 5240
1⤵
PID:5876

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5480
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:6184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 664
  2⤵
  - Program crash
  PID:6868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 916 -ip 916
1⤵
PID:5820

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7112
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:7076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 672
  2⤵
  - Program crash
  PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4540 -ip 4540
1⤵
PID:1572

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1104
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 664
  2⤵
  - Program crash
  PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4392 -ip 4392
1⤵
PID:6780

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 636
  2⤵
  - Program crash
  PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5436 -ip 5436
1⤵
PID:5556

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1408
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 632
  2⤵
  - Program crash
  PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1940 -ip 1940
1⤵
PID:6716

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3968
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 632
  2⤵
  - Program crash
  PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1824 -ip 1824
1⤵
PID:5364

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1224
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 672
  2⤵
  - Program crash
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3260 -ip 3260
1⤵
PID:7116

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1752
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 692
  2⤵
  - Program crash
  PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3364 -ip 3364
1⤵
PID:820

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7004
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 696
  2⤵
  - Program crash
  PID:5380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4532 -ip 4532
1⤵
PID:1724

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 664
  2⤵
  - Program crash
  PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2888 -ip 2888
1⤵
PID:6196

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6436
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 632
  2⤵
  - Program crash
  PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1768 -ip 1768
1⤵
PID:3544

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:6804
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7032
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 664
  2⤵
  - Program crash
  PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6804 -ip 6804
1⤵
PID:4616

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 664
  2⤵
  - Program crash
  PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4092 -ip 4092
1⤵
PID:260

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6724
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4068
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 632
  2⤵
  - Program crash
  PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6724 -ip 6724
1⤵
PID:2840

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3692
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 632
  2⤵
  - Program crash
  PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3692 -ip 3692
1⤵
PID:1932

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5476
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5064
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 672
  2⤵
  - Program crash
  PID:6208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 5476 -ip 5476
1⤵
PID:2404

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5424
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6904
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 664
  2⤵
  - Program crash
  PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5424 -ip 5424
1⤵
PID:1480

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4504
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 632
  2⤵
  - Program crash
  PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2392 -ip 2392
1⤵
PID:2088

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2140
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5612
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1296
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 632
  2⤵
  - Program crash
  PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2140 -ip 2140
1⤵
PID:7016

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1844
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2416
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 664
  2⤵
  - Program crash
  PID:5752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 1844 -ip 1844
1⤵
PID:1676

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5744
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 664
  2⤵
  - Program crash
  PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5744 -ip 5744
1⤵
PID:1132

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4764
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6140
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 664
  2⤵
  - Program crash
  PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4764 -ip 4764
1⤵
PID:6120

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:7144
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5816
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7144 -s 632
  2⤵
  - Program crash
  PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 7144 -ip 7144
1⤵
PID:1180

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2732
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5148
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 668
  2⤵
  - Program crash
  PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2732 -ip 2732
1⤵
PID:2024

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1308
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5928
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 664
  2⤵
  - Program crash
  PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1308 -ip 1308
1⤵
PID:4568

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5872
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6392 -s 696
  2⤵
  - Program crash
  PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6392 -ip 6392
1⤵
PID:5056

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6220
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4844
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 632
  2⤵
  - Program crash
  PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6220 -ip 6220
1⤵
PID:3284

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1904
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4364
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 664
  2⤵
  - Program crash
  PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1904 -ip 1904
1⤵
PID:6472

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6528
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6176
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 632
  2⤵
  - Program crash
  PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6528 -ip 6528
1⤵
PID:1912

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:7052
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:944
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7052 -s 632
  2⤵
  - Program crash
  PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7052 -ip 7052
1⤵
PID:3148

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1216
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3076
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 664
  2⤵
  - Program crash
  PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1216 -ip 1216
1⤵
PID:5408

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1032
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6428
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 632
  2⤵
  - Program crash
  PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1032 -ip 1032
1⤵
PID:3060

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1556
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7152
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 664
  2⤵
  - Program crash
  PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1556 -ip 1556
1⤵
PID:240

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6620
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6620 -s 664
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6620 -ip 6620
1⤵
PID:1944

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1720
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2376
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 664
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1720 -ip 1720
1⤵
PID:1164

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5700
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4308
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 632
  2⤵
  - Program crash
  PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5700 -ip 5700
1⤵
PID:2404

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5064
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1804
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 672
  2⤵
  - Program crash
  PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5064 -ip 5064
1⤵
PID:1480

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6900
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:948
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6900 -s 672
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 6900 -ip 6900
1⤵
PID:2488

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6968
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1244
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 632
  2⤵
  - Program crash
  PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6968 -ip 6968
1⤵
PID:7016

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6484
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6024
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 664
  2⤵
  - Program crash
  PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6484 -ip 6484
1⤵
PID:1676

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2684
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 632
  2⤵
  - Program crash
  PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2684 -ip 2684
1⤵
PID:3168

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6432
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6204
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 632
  2⤵
  - Program crash
  PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6432 -ip 6432
1⤵
PID:6004

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2180
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4304
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 664
  2⤵
  - Program crash
  PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2180 -ip 2180
1⤵
PID:6872

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1128
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:784
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 248
  2⤵
  - Program crash
  PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1128 -ip 1128
1⤵
PID:2216

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2852
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5188
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 632
  2⤵
  - Program crash
  PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2852 -ip 2852
1⤵
PID:1964

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2856
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1612
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 632
  2⤵
  PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2856 -ip 2856
1⤵
PID:2144

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1684
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6736
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 664
  2⤵
  PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1684 -ip 1684
1⤵
PID:7108

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4464
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2600
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 632
  2⤵
  PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4464 -ip 4464
1⤵
PID:6472

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6088
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4472
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 632
  2⤵
  PID:6272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6088 -ip 6088
1⤵
PID:5960

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6028
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5380
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 632
  2⤵
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 6028 -ip 6028
1⤵
PID:6944

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6660
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3544
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 672
  2⤵
  PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6660 -ip 6660
1⤵
PID:5724

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3412
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4656
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 632
  2⤵
  PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3412 -ip 3412
1⤵
PID:5484

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:236
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1980
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 236 -s 664
  2⤵
  PID:276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 236 -ip 236
1⤵
PID:6988

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2840
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6624
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 696
  2⤵
  PID:6360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2840 -ip 2840
1⤵
PID:900

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5716
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1772
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 632
  2⤵
  PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5716 -ip 5716
1⤵
PID:1152

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5032
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6208
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 672
  2⤵
  PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5032 -ip 5032
1⤵
PID:5528

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3560
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7140
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 632
  2⤵
  PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3560 -ip 3560
1⤵
PID:6752

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3688
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 632
  2⤵
  PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3688 -ip 3688
1⤵
PID:2964

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4920
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6708
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 664
  2⤵
  PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4920 -ip 4920
1⤵
PID:6632

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5612
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4628
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 664
  2⤵
  PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5612 -ip 5612
1⤵
PID:5572

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6356
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1260
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6356 -s 672
  2⤵
  PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6356 -ip 6356
1⤵
PID:4228

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4564
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6868
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 632
  2⤵
  PID:6424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4564 -ip 4564
1⤵
PID:1360

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6364
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4244
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 632
  2⤵
  PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6364 -ip 6364
1⤵
PID:3308

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4580
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5708
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 632
  2⤵
  PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4580 -ip 4580
1⤵
PID:1524

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2608
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6784
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 672
  2⤵
  PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2608 -ip 2608
1⤵
PID:4728

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5588
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6116
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 632
  2⤵
  PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5588 -ip 5588
1⤵
PID:5468

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3588
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1808
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 632
  2⤵
  PID:6772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3588 -ip 3588
1⤵
PID:1212

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3784
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2692
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 664
  2⤵
  PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3784 -ip 3784
1⤵
PID:1344

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2080
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6396
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 632
  2⤵
  PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2080 -ip 2080
1⤵
PID:4812

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4780
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4484
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 632
  2⤵
  PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4780 -ip 4780
1⤵
PID:6460

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5388
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2752
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 696
  2⤵
  PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5388 -ip 5388
1⤵
PID:6848

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4656
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 632
  2⤵
  PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5392 -ip 5392
1⤵
PID:2928

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:6316
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:276
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:7148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 632
  2⤵
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6316 -ip 6316
1⤵
PID:3204

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:484
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6852
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 484 -s 632
  2⤵
  PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 484 -ip 484
1⤵
PID:3500

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5848
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:436
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5848 -s 664
  2⤵
  PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5848 -ip 5848
1⤵
PID:3920

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1204
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5616
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 664
  2⤵
  PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1204 -ip 1204
1⤵
PID:2148

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1084
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7160
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 672
  2⤵
  PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 1084 -ip 1084
1⤵
PID:2308

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2584
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2360
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 672
  2⤵
  PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2584 -ip 2584
1⤵
PID:2056

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4272.vbs

Path C:\4272.vbs
Size 500B
SHA256 a8e63262d5bbb971f549515ed22f3a945323b9cb01ee55dfe317623cdb03a9b3
MD5 c6a5bdc7041afcff60a0551f7df4ffcf
SHA1 b73a08f80388f3d241541b7e51b7ba673ffba16d
SHA512 cdda73ee91d72e6b5f21feefea83c625b77e1fb0770dfdd6b2e0c520871f2d9809eba940efa951dd6af8c904dc6903bf49a732cd9d53a49e494c37531c8d3882
TLSH
T19AF020069D65C63FC52590B34A71D00EC1A0A8181526F32417C1C9C8994A7B45F4F973
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 792KB
SHA256 e78c06600581328649e63ba09b8d8984c2c9393d656c598fd4bdf14e045e0b37
MD5 b0e7bfba3beea28026911d1333dc4560
SHA1 a85e8ba59d883b7f5fa831b96d098fb12c313083
SHA512 b6eb2dc1068c5d1662c21cafebb6eb683ec7d1a2bde2d09dbc696840a15b8bca7d0946b094808df27de84c59d06479b9ea2878f6576dd026ea19c78e04eb7438
SSDEEP 12288:cThR2oreHPuKNajprUkz0+NsqJnWNaYXkHihBq8BUn4ztqI5rXhVIqn:IKmKNUHI+NsqwYYX/LLBg48I5rRVr
TLSH
T15505D0D2F3D5195AD6AC363D2748859E4CF2FEB595C25C88336D43BC0A0875AACCFA12
MD5 SHA1 SHA512 SSDEEP TLSH