gh0strat | 0564370886a2f3478bdaad1f3e4b71c6a8c0429d52bd8a3273ad4268aa08edea

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe
Size 792KB
Sample260808-eq544ss1dw
SHA256 0564370886a2f3478bdaad1f3e4b71c6a8c0429d52bd8a3273ad4268aa08edea
MD5 0cde4fde292bf47fe3fe336c8bec99a0
SHA1 d0ac1c11f241e53ece092499093ad76224afd18e
SHA512 283718e7af49842e54ee9ea85a44aa3015529a3550642786aa692451907a72492c2fa924467eddb32ea058cb72ea41c745137c9eb06ad7d547700194a6efec8a
SSDEEP 12288:cThR2oreHPuKNajprUkz0+NsqJnWNaYXkHihBq8BUn4ztqI5rXhVIqn:IKmKNUHI+NsqwYYX/LLBg48I5rRVr
TLSH
T1E805D0D2F3D5195AD6AC363D2748859E4CF2FEB595C25C88336D43BC0A0875AACCFA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution gh0strat xmrig miner rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral2/memory/4832-0-0x0000000010000000-0x00000000100C9000-memory.dmp	family_gh0strat
behavioral2/memory/5740-5-0x0000000010000000-0x00000000100C9000-memory.dmp	family_gh0strat

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/4832-0-0x0000000010000000-0x00000000100C9000-memory.dmp	xmrig
behavioral2/memory/5740-5-0x0000000010000000-0x00000000100C9000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
5040	WScript.exe

Executes dropped EXE 64 IoCs

pid	Process
5740	svchost.exe
2524	svchost.exe
1528	svchost.exe
4344	svchost.exe
2004	svchost.exe
4280	svchost.exe
5068	svchost.exe
5896	svchost.exe
2460	svchost.exe
3332	svchost.exe
2144	svchost.exe
1828	svchost.exe
2320	svchost.exe
3532	svchost.exe
2092	svchost.exe
5084	svchost.exe
2684	svchost.exe
4156	svchost.exe
1984	svchost.exe
1468	svchost.exe
2408	svchost.exe
5208	svchost.exe
3028	svchost.exe
2572	svchost.exe
5188	svchost.exe
4816	svchost.exe
4532	svchost.exe
1376	svchost.exe
856	svchost.exe
1016	svchost.exe
2676	svchost.exe
3248	svchost.exe
2920	svchost.exe
2108	svchost.exe
4868	svchost.exe
5584	svchost.exe
1732	svchost.exe
2536	svchost.exe
3384	svchost.exe
3228	svchost.exe
2432	svchost.exe
2712	svchost.exe
3236	svchost.exe
4124	svchost.exe
4240	svchost.exe
4284	svchost.exe
1560	svchost.exe
8	svchost.exe
840	svchost.exe
3012	svchost.exe
3584	svchost.exe
4216	svchost.exe
5848	svchost.exe
4176	svchost.exe
5968	svchost.exe
4156	svchost.exe
424	svchost.exe
2752	svchost.exe
3396	svchost.exe
5156	svchost.exe
2972	svchost.exe
252	svchost.exe
200	svchost.exe
2900	svchost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5040	WScript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4400	5740	WerFault.exe	88
2424	4344	WerFault.exe	95
3308	5068	WerFault.exe	100
2248	3332	WerFault.exe	105
5132	2320	WerFault.exe	110
5968	5084	WerFault.exe	115
3828	1984	WerFault.exe	120
4436	5208	WerFault.exe	125
1228	5188	WerFault.exe	130
4488	1376	WerFault.exe	135
3744	2676	WerFault.exe	140
4764	2108	WerFault.exe	145
5380	1732	WerFault.exe	150
4864	3228	WerFault.exe	156
3880	3236	WerFault.exe	161
5568	4284	WerFault.exe	166
1328	840	WerFault.exe	171
4948	4216	WerFault.exe	176
2148	5968	WerFault.exe	181
3664	2752	WerFault.exe	186
2160	2972	WerFault.exe	191
5252	2900	WerFault.exe	196
5944	3776	WerFault.exe	201
1368	3440	WerFault.exe	206
5584	5948	WerFault.exe	211
2664	1968	WerFault.exe	216
4484	1300	WerFault.exe	221
3880	4296	WerFault.exe	226
6020	6088	WerFault.exe	231
2868	8	WerFault.exe	236
5924	3532	WerFault.exe	241
5916	1336	WerFault.exe	246
4388	5012	WerFault.exe	251
1500	3736	WerFault.exe	256
1928	2572	WerFault.exe	261
4840	4532	WerFault.exe	266
5868	1704	WerFault.exe	271
1012	5444	WerFault.exe	276
4556	5832	WerFault.exe	281
2292	5988	WerFault.exe	286
2376	4512	WerFault.exe	291
5052	4716	WerFault.exe	296
744	5416	WerFault.exe	301
3496	5928	WerFault.exe	306
1972	5016	WerFault.exe	311
5704	4324	WerFault.exe	316
620	2132	WerFault.exe	321
5596	4436	WerFault.exe	326
2984	3576	WerFault.exe	331
5736	2992	WerFault.exe	336
4836	1928	WerFault.exe	341
2960	1856	WerFault.exe	346
4764	5324	WerFault.exe	351
3068	1324	WerFault.exe	356
2516	4680	WerFault.exe	361
1308	2276	WerFault.exe	366
2776	2916	WerFault.exe	371
1064	3308	WerFault.exe	376
2868	4644	WerFault.exe	381
2684	5440	WerFault.exe	386
4156	1972	WerFault.exe	391
436	2764	WerFault.exe	396
960	4684	WerFault.exe	401
4760	2400	WerFault.exe	406

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe
2524	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 5040	4832	2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe	89
PID 5740 wrote to memory of 2524	5740	svchost.exe	90
PID 5740 wrote to memory of 1528	5740	svchost.exe	91
PID 4344 wrote to memory of 2004	4344	svchost.exe	96
PID 4344 wrote to memory of 4280	4344	svchost.exe	97
PID 5068 wrote to memory of 5896	5068	svchost.exe	101
PID 5068 wrote to memory of 2460	5068	svchost.exe	102
PID 3332 wrote to memory of 2144	3332	svchost.exe	106
PID 3332 wrote to memory of 1828	3332	svchost.exe	107
PID 2320 wrote to memory of 3532	2320	svchost.exe	111
PID 2320 wrote to memory of 2092	2320	svchost.exe	112
PID 5084 wrote to memory of 2684	5084	svchost.exe	116
PID 5084 wrote to memory of 4156	5084	svchost.exe	117
PID 1984 wrote to memory of 1468	1984	svchost.exe	121
PID 1984 wrote to memory of 2408	1984	svchost.exe	122
PID 5208 wrote to memory of 3028	5208	svchost.exe	126
PID 5208 wrote to memory of 2572	5208	svchost.exe	127
PID 5188 wrote to memory of 4816	5188	svchost.exe	131
PID 5188 wrote to memory of 4532	5188	svchost.exe	132
PID 1376 wrote to memory of 856	1376	svchost.exe	136
PID 1376 wrote to memory of 1016	1376	svchost.exe	137
PID 2676 wrote to memory of 3248	2676	svchost.exe	141
PID 2676 wrote to memory of 2920	2676	svchost.exe	142
PID 2108 wrote to memory of 4868	2108	svchost.exe	146
PID 2108 wrote to memory of 5584	2108	svchost.exe	147
PID 1732 wrote to memory of 2536	1732	svchost.exe	152
PID 1732 wrote to memory of 3384	1732	svchost.exe	153
PID 3228 wrote to memory of 2432	3228	svchost.exe	157
PID 3228 wrote to memory of 2712	3228	svchost.exe	158
PID 3236 wrote to memory of 4124	3236	svchost.exe	162
PID 3236 wrote to memory of 4240	3236	svchost.exe	163
PID 4284 wrote to memory of 1560	4284	svchost.exe	167
PID 4284 wrote to memory of 8	4284	svchost.exe	168
PID 840 wrote to memory of 3012	840	svchost.exe	172
PID 840 wrote to memory of 3584	840	svchost.exe	173
PID 4216 wrote to memory of 5848	4216	svchost.exe	177
PID 4216 wrote to memory of 4176	4216	svchost.exe	178
PID 5968 wrote to memory of 4156	5968	svchost.exe	182
PID 5968 wrote to memory of 424	5968	svchost.exe	183
PID 2752 wrote to memory of 3396	2752	svchost.exe	187
PID 2752 wrote to memory of 5156	2752	svchost.exe	188
PID 2972 wrote to memory of 252	2972	svchost.exe	192
PID 2972 wrote to memory of 200	2972	svchost.exe	193
PID 2900 wrote to memory of 4532	2900	svchost.exe	197
PID 2900 wrote to memory of 5640	2900	svchost.exe	198
PID 3776 wrote to memory of 1704	3776	svchost.exe	202
PID 3776 wrote to memory of 5996	3776	svchost.exe	203
PID 3440 wrote to memory of 4140	3440	svchost.exe	207
PID 3440 wrote to memory of 2012	3440	svchost.exe	208
PID 5948 wrote to memory of 5832	5948	svchost.exe	212
PID 5948 wrote to memory of 1076	5948	svchost.exe	213
PID 1968 wrote to memory of 1584	1968	svchost.exe	217
PID 1968 wrote to memory of 2732	1968	svchost.exe	218
PID 1300 wrote to memory of 1588	1300	svchost.exe	222
PID 1300 wrote to memory of 5484	1300	svchost.exe	223
PID 4296 wrote to memory of 2776	4296	svchost.exe	227
PID 4296 wrote to memory of 5528	4296	svchost.exe	228
PID 6088 wrote to memory of 1360	6088	svchost.exe	232
PID 6088 wrote to memory of 2460	6088	svchost.exe	233
PID 8 wrote to memory of 1476	8	svchost.exe	237
PID 8 wrote to memory of 5440	8	svchost.exe	238
PID 3532 wrote to memory of 4264	3532	svchost.exe	242
PID 3532 wrote to memory of 5904	3532	svchost.exe	243
PID 1336 wrote to memory of 2020	1336	svchost.exe	247

C:\Users\Admin\AppData\Local\Temp\2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0cde4fde292bf47fe3fe336c8bec99a0_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\840.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5040

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 712
  2⤵
  - Program crash
  PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5740 -ip 5740
1⤵
PID:4136

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2004
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 708
  2⤵
  - Program crash
  PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4344 -ip 4344
1⤵
PID:4296

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5896
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 664
  2⤵
  - Program crash
  PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5068 -ip 5068
1⤵
PID:5708

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 696
  2⤵
  - Program crash
  PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3332 -ip 3332
1⤵
PID:2096

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 696
  2⤵
  - Program crash
  PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2320 -ip 2320
1⤵
PID:5236

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 632
  2⤵
  - Program crash
  PID:5968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5084 -ip 5084
1⤵
PID:3852

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1468
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 648
  2⤵
  - Program crash
  PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1984 -ip 1984
1⤵
PID:4112

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 668
  2⤵
  - Program crash
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5208 -ip 5208
1⤵
PID:5872

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 672
  2⤵
  - Program crash
  PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5188 -ip 5188
1⤵
PID:4796

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 696
  2⤵
  - Program crash
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1376 -ip 1376
1⤵
PID:2156

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 636
  2⤵
  - Program crash
  PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2676 -ip 2676
1⤵
PID:1856

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 664
  2⤵
  - Program crash
  PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2108 -ip 2108
1⤵
PID:2600

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 664
  2⤵
  - Program crash
  PID:5380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1732 -ip 1732
1⤵
PID:4680

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 668
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3228 -ip 3228
1⤵
PID:4652

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 648
  2⤵
  - Program crash
  PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3236 -ip 3236
1⤵
PID:1748

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1560
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 624
  2⤵
  - Program crash
  PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4284 -ip 4284
1⤵
PID:624

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 648
  2⤵
  - Program crash
  PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 840 -ip 840
1⤵
PID:1800

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5848
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 664
  2⤵
  - Program crash
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4216 -ip 4216
1⤵
PID:5016

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4156
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 632
  2⤵
  - Program crash
  PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5968 -ip 5968
1⤵
PID:3428

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 668
  2⤵
  - Program crash
  PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2752 -ip 2752
1⤵
PID:2284

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  PID:252
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 696
  2⤵
  - Program crash
  PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2972 -ip 2972
1⤵
PID:6076

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 632
  2⤵
  - Program crash
  PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2900 -ip 2900
1⤵
PID:3676

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1704
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 692
  2⤵
  - Program crash
  PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3776 -ip 3776
1⤵
PID:2620

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4140
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 648
  2⤵
  - Program crash
  PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3440 -ip 3440
1⤵
PID:1436

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5832
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 664
  2⤵
  - Program crash
  PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5948 -ip 5948
1⤵
PID:1652

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1584
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 648
  2⤵
  - Program crash
  PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1968 -ip 1968
1⤵
PID:4680

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1588
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 696
  2⤵
  - Program crash
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1300 -ip 1300
1⤵
PID:4512

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2776
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 632
  2⤵
  - Program crash
  PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4296 -ip 4296
1⤵
PID:5708

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1360
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 672
  2⤵
  - Program crash
  PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6088 -ip 6088
1⤵
PID:4084

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1476
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 632
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8 -ip 8
1⤵
PID:5132

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4264
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 664
  2⤵
  - Program crash
  PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3532 -ip 3532
1⤵
PID:2240

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2020
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 664
  2⤵
  - Program crash
  PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1336 -ip 1336
1⤵
PID:3828

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5012
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 632
  2⤵
  - Program crash
  PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5012 -ip 5012
1⤵
PID:240

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3736
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2984
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 692
  2⤵
  - Program crash
  PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3736 -ip 3736
1⤵
PID:6076

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2572
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:704
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 664
  2⤵
  - Program crash
  PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2572 -ip 2572
1⤵
PID:4208

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:856
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 664
  2⤵
  - Program crash
  PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4532 -ip 4532
1⤵
PID:2620

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1704
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5256
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 696
  2⤵
  - Program crash
  PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1704 -ip 1704
1⤵
PID:2036

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5444
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2184
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 664
  2⤵
  - Program crash
  PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5444 -ip 5444
1⤵
PID:1324

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5832
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3540
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 632
  2⤵
  - Program crash
  PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5832 -ip 5832
1⤵
PID:4384

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5988
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:936
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 632
  2⤵
  - Program crash
  PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5988 -ip 5988
1⤵
PID:1840

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4512
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5668
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 664
  2⤵
  - Program crash
  PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4512 -ip 4512
1⤵
PID:2916

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4716
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4956
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 696
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4716 -ip 4716
1⤵
PID:3308

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5416
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6020
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 672
  2⤵
  - Program crash
  PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5416 -ip 5416
1⤵
PID:5660

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5928
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1536
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 696
  2⤵
  - Program crash
  PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5928 -ip 5928
1⤵
PID:6092

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5016
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5848
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 664
  2⤵
  - Program crash
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5016 -ip 5016
1⤵
PID:4264

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4324
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3356
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 664
  2⤵
  - Program crash
  PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4324 -ip 4324
1⤵
PID:4988

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2132
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 664
  2⤵
  - Program crash
  PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2132 -ip 2132
1⤵
PID:4684

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4436
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3596
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 624
  2⤵
  - Program crash
  PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4436 -ip 4436
1⤵
PID:2284

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3576
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2484
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 632
  2⤵
  - Program crash
  PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3576 -ip 3576
1⤵
PID:1500

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2992
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2372
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 632
  2⤵
  - Program crash
  PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2992 -ip 2992
1⤵
PID:1116

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1928
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4460
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 632
  2⤵
  - Program crash
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1928 -ip 1928
1⤵
PID:3728

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1856
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:956
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 664
  2⤵
  - Program crash
  PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1856 -ip 1856
1⤵
PID:5860

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5324
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 648
  2⤵
  - Program crash
  PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5324 -ip 5324
1⤵
PID:5908

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1324
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2184
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 692
  2⤵
  - Program crash
  PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1324 -ip 1324
1⤵
PID:1860

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4680
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3540
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 668
  2⤵
  - Program crash
  PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4680 -ip 4680
1⤵
PID:2280

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2276
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3512
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 632
  2⤵
  - Program crash
  PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2276 -ip 2276
1⤵
PID:4144

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2916
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3800
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 664
  2⤵
  - Program crash
  PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2916 -ip 2916
1⤵
PID:3880

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3308
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2072
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 624
  2⤵
  - Program crash
  PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3308 -ip 3308
1⤵
PID:1848

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4644
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4780
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 668
  2⤵
  - Program crash
  PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4644 -ip 4644
1⤵
PID:5280

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5440
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:3852
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 640
  2⤵
  - Program crash
  PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5440 -ip 5440
1⤵
PID:4828

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1972
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4560
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 664
  2⤵
  - Program crash
  PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1972 -ip 1972
1⤵
PID:3152

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2764
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5916
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 632
  2⤵
  - Program crash
  PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2764 -ip 2764
1⤵
PID:368

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4684
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1808
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 692
  2⤵
  - Program crash
  PID:960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4684 -ip 4684
1⤵
PID:3596

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2400
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2656
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 640
  2⤵
  - Program crash
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2400 -ip 2400
1⤵
PID:4404

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1228
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1316
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 632
  2⤵
  PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1228 -ip 1228
1⤵
PID:1488

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3676
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5912
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 664
  2⤵
  PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3676 -ip 3676
1⤵
PID:672

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4088
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:6136
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 664
  2⤵
  PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4088 -ip 4088
1⤵
PID:3416

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2052
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3912
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 632
  2⤵
  PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2052 -ip 2052
1⤵
PID:3068

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2664
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3216
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 632
  2⤵
  PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2664 -ip 2664
1⤵
PID:3336

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:5532
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5692
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 704
  2⤵
  PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5532 -ip 5532
1⤵
PID:936

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:1772
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5528
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 692
  2⤵
  PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1772 -ip 1772
1⤵
PID:2776

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3392
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2096
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 664
  2⤵
  PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3392 -ip 3392
1⤵
PID:1836

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4028
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1380
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 672
  2⤵
  PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4028 -ip 4028
1⤵
PID:4100

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:3012
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 664
  2⤵
  PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3012 -ip 3012
1⤵
PID:5236

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4700
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1512
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 692
  2⤵
  PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4700 -ip 4700
1⤵
PID:4300

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4844
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:264
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 664
  2⤵
  PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4844 -ip 4844
1⤵
PID:3604

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4220
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6060
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 696
  2⤵
  PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4220 -ip 4220
1⤵
PID:3596

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5608
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5648
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 664
  2⤵
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5608 -ip 5608
1⤵
PID:4148

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:2796
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2656
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 696
  2⤵
  PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2796 -ip 2796
1⤵
PID:5568

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4920
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:260
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 668
  2⤵
  PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4920 -ip 4920
1⤵
PID:1220

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4308
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 668
  2⤵
  PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4308 -ip 4308
1⤵
PID:4312

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4912
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4892
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:2480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 684
  2⤵
  PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4912 -ip 4912
1⤵
PID:5908

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4668
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:756
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 708
  2⤵
  PID:6120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 4668
1⤵
PID:2332

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
PID:4292
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:1584
- C:\Windows\svchost.exe
  C:\Windows\svchost.exe Win7
  2⤵
  PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 696
  2⤵
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4292 -ip 4292
1⤵
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

840.vbs

Path C:\840.vbs
Size 500B
SHA256 581af73d1d014478b52280688de2965dc9e99af844120f23614840aa5900cee6
MD5 3e2e7d8af4a4549038969cd7b064a0a9
SHA1 e4c606c8f62ced44eaad6dc5287967023b5c7f91
SHA512 0fb3118aeb241156321f7df2a845720d55ed2a17d0de0492c63fbe05427b49e91f8d90034dfc5783b70e2ee4b93b99b42eadb0f62ac819beb8da134a5ac9c3f7
TLSH
T1A0F026029D6AD62FD92191B34AB1C00FC2A4B8181626F31857D0C9C8999A7786F5FA63
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 792KB
SHA256 0564370886a2f3478bdaad1f3e4b71c6a8c0429d52bd8a3273ad4268aa08edea
MD5 0cde4fde292bf47fe3fe336c8bec99a0
SHA1 d0ac1c11f241e53ece092499093ad76224afd18e
SHA512 283718e7af49842e54ee9ea85a44aa3015529a3550642786aa692451907a72492c2fa924467eddb32ea058cb72ea41c745137c9eb06ad7d547700194a6efec8a
SSDEEP 12288:cThR2oreHPuKNajprUkz0+NsqJnWNaYXkHihBq8BUn4ztqI5rXhVIqn:IKmKNUHI+NsqwYYX/LLBg48I5rRVr
TLSH
T1E805D0D2F3D5195AD6AC363D2748859E4CF2FEB595C25C88336D43BC0A0875AACCFA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4832-0-0x0000000010000000-0x00000000100C9000-memory.dmp

Download

memory/5740-5-0x0000000010000000-0x00000000100C9000-memory.dmp

Download