darkcomet | 9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef

Analysis

max time kernel
152s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Size

752KB
MD5

c6b4e7633ed37e2ce5b905564f81c57d
SHA1

733dd212f469dc646f68cd4c0aa7d77ceade2ec2
SHA256

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef
SHA512

6259f10d960ca0a08160ee997d05e28679268e05174a0f575cb98500109783ee2553d37d2c28af54e23cc1c394c8b98d403af77ea8f05f0fcec0315a0f1361b7
SSDEEP

12288:bMES5WaXKtg5gAFo4hd3cgBRIKjpTKh5Or2thYXgO03zfbR:bMPfKybFxJMATKh5LthygO03Tt

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

stereohacks.ddns.net:1604

Mutex

DCMIN_MUTEX-5Y95VAZ

Attributes

gencode
w0dv9t4j5rYt
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4424	1432	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
1964	4260	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4392	4896	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4308	4084	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3112	1928	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3976	2568	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4128	452	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4832	3288	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4004	3392	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3064	5056	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4660	2552	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4368	3952	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4972	3260	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
1608	4820	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4352	2552	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3492	1924	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3044	1460	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4008	840	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
952	2528	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
1324	1924	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3688	4728	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5060	1612	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4008	3164	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4892	1480	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3848	2432	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
720	4968	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3648	3596	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
364	2404	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
216	3472	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2192	4220	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5436	5340	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5540	5452	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5828	5740	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
844	5288	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6040	5172	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2316	1664	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6036	5876	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5824	5992	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4520	5692	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
312	3236	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5280	4004	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5776	6040	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5280	4848	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5728	5244	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2316	5536	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3464	2220	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6212	5840	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6632	6252	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4100	6380	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6796	6628	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6368	6216	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6480	6180	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
1856	3452	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6884	6716	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6724	6496	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
4180	6256	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
3628	7104	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6724	6588	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6664	6624	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6196	7136	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
5160	6884	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6988	6784	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6420	7120	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
6788	6964	WerFault.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

pid	process
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

description	pid	process
Token: SeDebugPrivilege	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncreaseQuotaPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncreaseQuotaPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSecurityPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSecurityPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeTakeOwnershipPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeTakeOwnershipPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeLoadDriverPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeLoadDriverPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemProfilePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemProfilePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemtimePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemtimePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeProfSingleProcessPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeProfSingleProcessPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncBasePriorityPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncBasePriorityPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeCreatePagefilePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeCreatePagefilePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeBackupPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeBackupPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeRestorePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeRestorePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeShutdownPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeShutdownPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeDebugPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeDebugPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemEnvironmentPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemEnvironmentPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeChangeNotifyPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeRemoteShutdownPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeChangeNotifyPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeUndockPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeRemoteShutdownPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeManageVolumePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeUndockPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeImpersonatePrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeManageVolumePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeCreateGlobalPrivilege	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeImpersonatePrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 33	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeCreateGlobalPrivilege	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 34	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 33	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 35	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 34	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 36	808	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 35	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: 36	1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncreaseQuotaPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSecurityPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeTakeOwnershipPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeLoadDriverPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemProfilePrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemtimePrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeProfSingleProcessPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeIncBasePriorityPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeCreatePagefilePrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeBackupPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeRestorePrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeShutdownPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeDebugPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeSystemEnvironmentPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
Token: SeChangeNotifyPrivilege	4668	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

pid process

1316 9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

pid	process
1316	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 520
3⤵
- Program crash
PID:4424

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4224

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3528

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3988

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4204

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:476

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 528
3⤵
- Program crash
PID:1964

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2104

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2944

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3984

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 520
3⤵
- Program crash
PID:4392

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 520
3⤵
- Program crash
PID:4308

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:872

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1120

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:632

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 520
3⤵
- Program crash
PID:3112

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1844

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2568 -s 536
3⤵
- Program crash
PID:3976

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4436

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4712

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2828

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1136

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4768

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3212

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1976

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 520
3⤵
- Program crash
PID:4128

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5052

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 532
3⤵
- Program crash
PID:4832

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 532
3⤵
- Program crash
PID:4004

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3644

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4556

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1388

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1956

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3304

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 520
3⤵
- Program crash
PID:3064

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4364

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 516
3⤵
- Program crash
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 520
3⤵
- Program crash
PID:4352

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1328

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4664

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:536

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3916

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3440

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 520
3⤵
- Program crash
PID:4368

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4504

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4908

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5044

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3112

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4652

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5040

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3124

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4796

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4416

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3856

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 520
3⤵
- Program crash
PID:4972

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:628

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 536
3⤵
- Program crash
PID:1608

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2304

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1680

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4048

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4268

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:520

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2700

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2300

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:548

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4296

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1448

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4524

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1076

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4336

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1428

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4752

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2196

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3624

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1512

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2176

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4564

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1740

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2376

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2756

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4588

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 516
3⤵
- Program crash
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 520
3⤵
- Program crash
PID:1324

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 532
3⤵
- Program crash
PID:3044

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 528
3⤵
- Program crash
PID:4008

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 520
3⤵
- Program crash
PID:952

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 520
3⤵
- Program crash
PID:3688

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3220

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 520
3⤵
- Program crash
PID:5060

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 520
3⤵
- Program crash
PID:4008

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4440

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 520
3⤵
- Program crash
PID:4892

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3160

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4292

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1104

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 528
3⤵
- Program crash
PID:3848

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 520
3⤵
- Program crash
PID:720

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2148

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 520
3⤵
- Program crash
PID:3648

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 520
3⤵
- Program crash
PID:364

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 528
3⤵
- Program crash
PID:216

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 528
3⤵
- Program crash
PID:2192

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:668

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3480

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3520

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4216

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5144

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5264

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5340 -s 528
3⤵
- Program crash
PID:5436

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 532
3⤵
- Program crash
PID:5540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5556

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5596

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5668

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 532
3⤵
- Program crash
PID:5828

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5844

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5880

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5968

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6124

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1292

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5184

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5188

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5208

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5256

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 520
3⤵
- Program crash
PID:844

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5292

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5312

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5320

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5336

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5360

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5380

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5392

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5460

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5472

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5484

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5496

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5516

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5524

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5568

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5576

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5620

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5624

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5644

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5676

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5688

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5904

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6116

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4656

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5960

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5916

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6120

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:952

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5428

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2652

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5724

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6108

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5956

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3560

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5468

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1824

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6104

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6100

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5612

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1156

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 520
3⤵
- Program crash
PID:6040

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 520
3⤵
- Program crash
PID:2316

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5952

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5808

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5900

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 520
3⤵
- Program crash
PID:6036

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 520
3⤵
- Program crash
PID:5824

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5944

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5404

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4136

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6048

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5548

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 520
3⤵
- Program crash
PID:4520

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5888

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 540
3⤵
- Program crash
PID:312

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 520
3⤵
- Program crash
PID:5280

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5136

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 532
3⤵
- Program crash
PID:5776

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6096

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 524
3⤵
- Program crash
PID:5280

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 532
3⤵
- Program crash
PID:5728

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 520
3⤵
- Program crash
PID:2316

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 520
3⤵
- Program crash
PID:3464

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 528
3⤵
- Program crash
PID:6212

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6228

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6316

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6352

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6392

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6428

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6464

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6576

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6668

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6704

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6740

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6776

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6864

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6900

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6936

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6972

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7060

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7096

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6152

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6376

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6416

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6508

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6564

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6640

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6760

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6860

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6908

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6960

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6996

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6172

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6252 -s 520
3⤵
- Program crash
PID:6632

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6528

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6876

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6928

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7004

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7076

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6296

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2424

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6548

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6836

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6160

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6820

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6012

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6684

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6792

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6980

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7040

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6192

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6844

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3428

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6828

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6656

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6644

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6736

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2164

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6896

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7124

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6284

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6436

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6556

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6852

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6380 -s 528
3⤵
- Program crash
PID:4100

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3948

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 520
3⤵
- Program crash
PID:6796

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6812

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6920

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7068

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6216 -s 520
3⤵
- Program crash
PID:6368

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 520
3⤵
- Program crash
PID:6480

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6732

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 520
3⤵
- Program crash
PID:1856

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6244

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 540
3⤵
- Program crash
PID:6884

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6660

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6676

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:996

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6292

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6452

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6200

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 532
3⤵
- Program crash
PID:6724

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 528
3⤵
- Program crash
PID:4180

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6888

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7032

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6584

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6176

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7104 -s 528
3⤵
- Program crash
PID:3628

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6728

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5984

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6260

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 520
3⤵
- Program crash
PID:6724

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6368

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4180

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6800

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6332

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6840

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 532
3⤵
- Program crash
PID:6664

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6348

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 204
3⤵
- Program crash
PID:6196

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6204

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6884 -s 520
3⤵
- Program crash
PID:5160

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6400

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4928

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6784 -s 520
3⤵
- Program crash
PID:6988

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 544
3⤵
- Program crash
PID:6420

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1396

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6664

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6312

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6444

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7044

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7024

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 532
3⤵
- Program crash
PID:6788

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6796

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:456

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 520
3⤵
PID:6804

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 532
3⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7112

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7144

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6788

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4140

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6944

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4532

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6408

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6984 -s 520
3⤵
PID:6952

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6208

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6472

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:1856

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:6196

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7176

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7216

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7252

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7288

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7328

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7416

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7504

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7540

C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
"C:\Users\Admin\AppData\Local\Temp\9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe"
2⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1432 -ip 1432
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4260 -ip 4260
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4896 -ip 4896
1⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4084 -ip 4084
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1928 -ip 1928
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2568 -ip 2568
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 452 -ip 452
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3288 -ip 3288
1⤵
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3392 -ip 3392
1⤵
PID:760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5056 -ip 5056
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2552 -ip 2552
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4680 -ip 4680
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3684 -ip 3684
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3952 -ip 3952
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4504 -ip 4504
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 376 -ip 376
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3704 -ip 3704
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5040 -ip 5040
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1412 -ip 1412
1⤵
PID:592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3944 -ip 3944
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4472 -ip 4472
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3260 -ip 3260
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4820 -ip 4820
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4820 -ip 4820
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2552 -ip 2552
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1680 -ip 1680
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2012 -ip 2012
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3324 -ip 3324
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1204 -ip 1204
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1076 -ip 1076
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2196 -ip 2196
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3040 -ip 3040
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4916 -ip 4916
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4564 -ip 4564
1⤵
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3556 -ip 3556
1⤵
PID:3236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3668 -ip 3668
1⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3364 -ip 3364
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1540 -ip 1540
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 1924 -ip 1924
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1460 -ip 1460
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 840 -ip 840
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2528 -ip 2528
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1924 -ip 1924
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4728 -ip 4728
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1612 -ip 1612
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3164 -ip 3164
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1480 -ip 1480
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2432 -ip 2432
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4968 -ip 4968
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3596 -ip 3596
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2404 -ip 2404
1⤵
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3472 -ip 3472
1⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4220 -ip 4220
1⤵
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2296 -ip 2296
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4824 -ip 4824
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5340 -ip 5340
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5452 -ip 5452
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5740 -ip 5740
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5880 -ip 5880
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5968 -ip 5968
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5288 -ip 5288
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5572 -ip 5572
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 5624 -ip 5624
1⤵
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5568 -ip 5568
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5516 -ip 5516
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5400 -ip 5400
1⤵
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5524 -ip 5524
1⤵
PID:364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5644 -ip 5644
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5256 -ip 5256
1⤵
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5472 -ip 5472
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5208 -ip 5208
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5168 -ip 5168
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 5312 -ip 5312
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5188 -ip 5188
1⤵
PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5624 -ip 5624
1⤵
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5640 -ip 5640
1⤵
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6116 -ip 6116
1⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5960 -ip 5960
1⤵
PID:6032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3816 -ip 3816
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2652 -ip 2652
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6108 -ip 6108
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 6108 -ip 6108
1⤵
PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3560 -ip 3560
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1824 -ip 1824
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6084 -ip 6084
1⤵
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 5172 -ip 5172
1⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1664 -ip 1664
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5876 -ip 5876
1⤵
PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5992 -ip 5992
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5692 -ip 5692
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3236 -ip 3236
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4004 -ip 4004
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6040 -ip 6040
1⤵
PID:5976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4848 -ip 4848
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 5244 -ip 5244
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5536 -ip 5536
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2220 -ip 2220
1⤵
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5840 -ip 5840
1⤵
PID:6192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6228 -ip 6228
1⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6576 -ip 6576
1⤵
PID:6648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6776 -ip 6776
1⤵
PID:6844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6972 -ip 6972
1⤵
PID:7044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7096 -ip 7096
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6152 -ip 6152
1⤵
PID:6256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6272 -ip 6272
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6416 -ip 6416
1⤵
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 6564 -ip 6564
1⤵
PID:6660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6640 -ip 6640
1⤵
PID:6732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 6760 -ip 6760
1⤵
PID:6852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 7072 -ip 7072
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 6252 -ip 6252
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 6272 -ip 6272
1⤵
PID:6684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6612 -ip 6612
1⤵
PID:6816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7076 -ip 7076
1⤵
PID:6236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6160 -ip 6160
1⤵
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 6820 -ip 6820
1⤵
PID:6588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6012 -ip 6012
1⤵
PID:7156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6792 -ip 6792
1⤵
PID:6892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7040 -ip 7040
1⤵
PID:6292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6192 -ip 6192
1⤵
PID:6556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3428 -ip 3428
1⤵
PID:7136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6828 -ip 6828
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2164 -ip 2164
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6380 -ip 6380
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 6628 -ip 6628
1⤵
PID:6600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6216 -ip 6216
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6180 -ip 6180
1⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3452 -ip 3452
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6716 -ip 6716
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6496 -ip 6496
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6256 -ip 6256
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 7104 -ip 7104
1⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6588 -ip 6588
1⤵
PID:6472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6624 -ip 6624
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 7136 -ip 7136
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 6884 -ip 6884
1⤵
PID:6164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 6784 -ip 6784
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 7120 -ip 7120
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1396 -ip 1396
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1396 -ip 1396
1⤵
PID:6308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6312 -ip 6312
1⤵
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 5552 -ip 5552
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 7044 -ip 7044
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 6964 -ip 6964
1⤵
PID:6456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6604 -ip 6604
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 6484 -ip 6484
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 6984 -ip 6984
1⤵
PID:2392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6208 -ip 6208
1⤵
PID:6196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7328 -ip 7328
1⤵
PID:7396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 7416 -ip 7416
1⤵
PID:7484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-424-0x0000000000000000-mapping.dmp

Download
memory/476-216-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/476-212-0x0000000000000000-mapping.dmp

Download
memory/508-419-0x0000000000000000-mapping.dmp

Download
memory/508-423-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/536-582-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/632-305-0x0000000000000000-mapping.dmp

Download
memory/632-309-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/748-222-0x0000000000000000-mapping.dmp

Download
memory/748-226-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/808-159-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/808-151-0x0000000000000000-mapping.dmp

Download
memory/872-295-0x0000000000000000-mapping.dmp

Download
memory/872-299-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1120-304-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1120-300-0x0000000000000000-mapping.dmp

Download
memory/1136-384-0x0000000000000000-mapping.dmp

Download
memory/1136-388-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1232-491-0x0000000000000000-mapping.dmp

Download
memory/1232-495-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1316-150-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1316-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1316-378-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1316-164-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1316-133-0x0000000000000000-mapping.dmp

Download
memory/1316-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1328-574-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1352-246-0x0000000000000000-mapping.dmp

Download
memory/1352-250-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1364-338-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1364-334-0x0000000000000000-mapping.dmp

Download
memory/1368-505-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1368-501-0x0000000000000000-mapping.dmp

Download
memory/1388-500-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1388-496-0x0000000000000000-mapping.dmp

Download
memory/1432-148-0x0000000000760000-0x0000000000812000-memory.dmp

Filesize
712KB

Download
memory/1432-136-0x0000000000000000-mapping.dmp

Download
memory/1432-149-0x0000000000760000-0x0000000000812000-memory.dmp

Filesize
712KB

Download
memory/1432-143-0x0000000000760000-0x0000000000812000-memory.dmp

Filesize
712KB

Download
memory/1560-166-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1560-161-0x0000000000000000-mapping.dmp

Download
memory/1772-265-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1772-261-0x0000000000000000-mapping.dmp

Download
memory/1844-339-0x0000000000000000-mapping.dmp

Download
memory/1844-343-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1852-404-0x0000000000000000-mapping.dmp

Download
memory/1852-408-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1928-315-0x0000000000000000-mapping.dmp

Download
memory/1956-510-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1956-506-0x0000000000000000-mapping.dmp

Download
memory/1976-418-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1976-414-0x0000000000000000-mapping.dmp

Download
memory/1988-310-0x0000000000000000-mapping.dmp

Download
memory/1988-314-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2044-486-0x0000000000000000-mapping.dmp

Download
memory/2044-490-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2104-245-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2104-241-0x0000000000000000-mapping.dmp

Download
memory/2264-132-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/2264-293-0x0000000075010000-0x00000000755C1000-memory.dmp

Filesize
5.7MB

Download
memory/2336-182-0x0000000000000000-mapping.dmp

Download
memory/2336-186-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2548-177-0x0000000000000000-mapping.dmp

Download
memory/2548-181-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2552-540-0x0000000000000000-mapping.dmp

Download
memory/2568-344-0x0000000000000000-mapping.dmp

Download
memory/2828-377-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2828-373-0x0000000000000000-mapping.dmp

Download
memory/2944-255-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2944-251-0x0000000000000000-mapping.dmp

Download
memory/3084-594-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3212-399-0x0000000000000000-mapping.dmp

Download
memory/3212-403-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3268-393-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3268-389-0x0000000000000000-mapping.dmp

Download
memory/3288-443-0x0000000000000000-mapping.dmp

Download
memory/3304-515-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3304-511-0x0000000000000000-mapping.dmp

Download
memory/3312-539-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3312-535-0x0000000000000000-mapping.dmp

Download
memory/3392-457-0x0000000000000000-mapping.dmp

Download
memory/3440-611-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3528-187-0x0000000000000000-mapping.dmp

Download
memory/3528-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3644-471-0x0000000000000000-mapping.dmp

Download
memory/3644-475-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3720-221-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3720-217-0x0000000000000000-mapping.dmp

Download
memory/3780-207-0x0000000000000000-mapping.dmp

Download
memory/3780-211-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3824-409-0x0000000000000000-mapping.dmp

Download
memory/3824-413-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3916-586-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3984-260-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3984-256-0x0000000000000000-mapping.dmp

Download
memory/3988-197-0x0000000000000000-mapping.dmp

Download
memory/3988-201-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4084-280-0x0000000000000000-mapping.dmp

Download
memory/4120-329-0x0000000000000000-mapping.dmp

Download
memory/4120-333-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4204-202-0x0000000000000000-mapping.dmp

Download
memory/4204-206-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4224-171-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4224-167-0x0000000000000000-mapping.dmp

Download
memory/4236-196-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4236-192-0x0000000000000000-mapping.dmp

Download
memory/4260-227-0x0000000000000000-mapping.dmp

Download
memory/4364-534-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4364-530-0x0000000000000000-mapping.dmp

Download
memory/4388-176-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4388-172-0x0000000000000000-mapping.dmp

Download
memory/4424-590-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4428-379-0x0000000000000000-mapping.dmp

Download
memory/4428-383-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4436-362-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4436-358-0x0000000000000000-mapping.dmp

Download
memory/4556-476-0x0000000000000000-mapping.dmp

Download
memory/4556-480-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4592-485-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4592-481-0x0000000000000000-mapping.dmp

Download
memory/4664-578-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4668-160-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4668-155-0x0000000000000000-mapping.dmp

Download
memory/4684-557-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4712-372-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4712-368-0x0000000000000000-mapping.dmp

Download
memory/4768-398-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4768-394-0x0000000000000000-mapping.dmp

Download
memory/4896-266-0x0000000000000000-mapping.dmp

Download
memory/5036-367-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5036-363-0x0000000000000000-mapping.dmp

Download
memory/5052-438-0x0000000000000000-mapping.dmp

Download
memory/5052-442-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5056-516-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 2264 set thread context of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4224	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4388	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2548	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2336	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3528	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4236	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3988	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4204	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3780	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 476	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3720	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 748	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4260	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2104	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1352	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2944	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3984	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1772	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4896	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4084	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 872	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1120	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 632	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1988	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1928	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4120	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1364	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1844	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2568	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4436	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 5036	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4712	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2828	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4428	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1136	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3268	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4768	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3212	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1852	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3824	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1976	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 508	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 452	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 5052	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3288	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3392	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3644	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4556	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4592	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2044	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1232	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1388	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1368	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 1956	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3304	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 5056	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 4364	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 3312	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 set thread context of 2552	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe

description	pid	process	target process
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1316	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1432	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 808	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4668	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 1560	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4224	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4224	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4224	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe
PID 2264 wrote to memory of 4224	2264	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe	9d1dc55007a7468a9fdb6263681fd7426d192a3d29515bc031149ad2166560ef.exe