darkcomet | de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

Analysis

max time kernel
156s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Size

742KB
MD5

62bc51bab1e9d1c1e3814941aa1314aa
SHA1

92a9d44ca0603f5e88ce61deb3bc1c45f77082b5
SHA256

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781
SHA512

b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218
SSDEEP

12288:vn+gAN9VDTJ3kuHsldLbumM8oItMZzgRce67pxJ1s1hGi1EK4CbBwPHQtLx:PYxV3ILA8ohZzgKbpxJ12kWMCb1

Score

10^/10

darkcomet specialty persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

SPECIALty

tolaresfgc.ddns.net:6900

Mutex

DC_MUTEX-YE2HHZB

Attributes

gencode
VLcXYdECg7L7
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 64 IoCs

Processes:

IpOverUsbSvrc.exeatiesrx.exeatiesrx.exeIpOverUsbSvrc.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exeatiesrx.exe

pid	process
4920	IpOverUsbSvrc.exe
4852	atiesrx.exe
2296	atiesrx.exe
4512	IpOverUsbSvrc.exe
3832	atiesrx.exe
2544	atiesrx.exe
1604	atiesrx.exe
2996	atiesrx.exe
2340	atiesrx.exe
3720	atiesrx.exe
1244	atiesrx.exe
4584	atiesrx.exe
444	atiesrx.exe
2100	atiesrx.exe
4192	atiesrx.exe
3992	atiesrx.exe
5048	atiesrx.exe
1456	atiesrx.exe
1904	atiesrx.exe
2776	atiesrx.exe
4416	atiesrx.exe
812	atiesrx.exe
3180	atiesrx.exe
3740	atiesrx.exe
4680	atiesrx.exe
3868	atiesrx.exe
1952	atiesrx.exe
2304	atiesrx.exe
3148	atiesrx.exe
1196	atiesrx.exe
5108	atiesrx.exe
4420	atiesrx.exe
1600	atiesrx.exe
3872	atiesrx.exe
1552	atiesrx.exe
2352	atiesrx.exe
2856	atiesrx.exe
3476	atiesrx.exe
3068	atiesrx.exe
2896	atiesrx.exe
1536	atiesrx.exe
408	atiesrx.exe
2032	atiesrx.exe
3088	atiesrx.exe
1284	atiesrx.exe
1224	atiesrx.exe
5116	atiesrx.exe
860	atiesrx.exe
3436	atiesrx.exe
4292	atiesrx.exe
4264	atiesrx.exe
2692	atiesrx.exe
888	atiesrx.exe
5056	atiesrx.exe
772	atiesrx.exe
3432	atiesrx.exe
1708	atiesrx.exe
2444	atiesrx.exe
2864	atiesrx.exe
1624	atiesrx.exe
3052	atiesrx.exe
864	atiesrx.exe
4760	atiesrx.exe
4088	atiesrx.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exeatiesrx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	atiesrx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IpOverUsbSvrc.exeIpOverUsbSvrc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe"	IpOverUsbSvrc.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exeatiesrx.exe

description	pid	process	target process
PID 2312 set thread context of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 4852 set thread context of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2996	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2340	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3720	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1244	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4584	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 444	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2100	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4192	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3992	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 5048	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1456	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1904	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2776	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4416	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 812	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3180	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3740	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4680	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3868	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1952	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2304	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3148	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1196	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 5108	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4420	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1600	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3872	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1552	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2352	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2856	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3476	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3068	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2896	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1536	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 408	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2032	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3088	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1284	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1224	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 5116	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 860	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3436	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4292	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4264	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2692	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 888	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 5056	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 772	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3432	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1708	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2444	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 2864	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 1624	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3052	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 864	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4760	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4088	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 3704	4852	atiesrx.exe	atiesrx.exe
PID 4852 set thread context of 4580	4852	atiesrx.exe	atiesrx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 61 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3840	2296	WerFault.exe	atiesrx.exe
3440	3992	WerFault.exe	atiesrx.exe
3500	1456	WerFault.exe	atiesrx.exe
1800	2776	WerFault.exe	atiesrx.exe
4516	4680	WerFault.exe	atiesrx.exe
4136	3868	WerFault.exe	atiesrx.exe
2140	3148	WerFault.exe	atiesrx.exe
4488	1196	WerFault.exe	atiesrx.exe
4168	1600	WerFault.exe	atiesrx.exe
5052	3872	WerFault.exe	atiesrx.exe
1896	2352	WerFault.exe	atiesrx.exe
3140	3068	WerFault.exe	atiesrx.exe
480	408	WerFault.exe	atiesrx.exe
1084	3088	WerFault.exe	atiesrx.exe
4716	860	WerFault.exe	atiesrx.exe
840	772	WerFault.exe	atiesrx.exe
4556	1708	WerFault.exe	atiesrx.exe
2588	2444	WerFault.exe	atiesrx.exe
3028	1624	WerFault.exe	atiesrx.exe
780	1624	WerFault.exe	atiesrx.exe
4496	4760	WerFault.exe	atiesrx.exe
2412	3704	WerFault.exe	atiesrx.exe
4076	976	WerFault.exe	atiesrx.exe
3356	3988	WerFault.exe	atiesrx.exe
2872	4044	WerFault.exe	atiesrx.exe
2312	4476	WerFault.exe	atiesrx.exe
4520	4908	WerFault.exe	atiesrx.exe
4168	3760	WerFault.exe	atiesrx.exe
3336	3524	WerFault.exe	atiesrx.exe
3372	1180	WerFault.exe	atiesrx.exe
920	4340	WerFault.exe	atiesrx.exe
4260	3556	WerFault.exe	atiesrx.exe
3336	1408	WerFault.exe	atiesrx.exe
776	4636	WerFault.exe	atiesrx.exe
4920	3492	WerFault.exe	atiesrx.exe
2424	1716	WerFault.exe	atiesrx.exe
1512	4752	WerFault.exe	atiesrx.exe
4016	4720	WerFault.exe	atiesrx.exe
2116	4928	WerFault.exe	atiesrx.exe
1684	4928	WerFault.exe	atiesrx.exe
1084	2952	WerFault.exe	atiesrx.exe
2552	5036	WerFault.exe	atiesrx.exe
2152	4920	WerFault.exe	atiesrx.exe
2984	4168	WerFault.exe	atiesrx.exe
1300	2696	WerFault.exe	atiesrx.exe
2116	4496	WerFault.exe	atiesrx.exe
3048	1192	WerFault.exe	atiesrx.exe
4072	2592	WerFault.exe	atiesrx.exe
4124	2052	WerFault.exe	atiesrx.exe
4208	776	WerFault.exe	atiesrx.exe
3688	1308	WerFault.exe	atiesrx.exe
2212	920	WerFault.exe	atiesrx.exe
2212	1844	WerFault.exe	atiesrx.exe
3780	2212	WerFault.exe	atiesrx.exe
4592	2212	WerFault.exe	atiesrx.exe
2484	4072	WerFault.exe	atiesrx.exe
1300	4592	WerFault.exe	atiesrx.exe
3244	2984	WerFault.exe	atiesrx.exe
3244	2484	WerFault.exe	atiesrx.exe
1004	4912	WerFault.exe	atiesrx.exe
5140	1692	WerFault.exe	atiesrx.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exeIpOverUsbSvrc.exe

pid	process
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
4920	IpOverUsbSvrc.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exede3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exeIpOverUsbSvrc.exeatiesrx.exeIpOverUsbSvrc.exeatiesrx.exeatiesrx.exe

description	pid	process
Token: SeDebugPrivilege	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeIncreaseQuotaPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeSecurityPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeTakeOwnershipPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeLoadDriverPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeSystemProfilePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeSystemtimePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeProfSingleProcessPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeIncBasePriorityPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeCreatePagefilePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeBackupPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeRestorePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeShutdownPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeDebugPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeSystemEnvironmentPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeChangeNotifyPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeRemoteShutdownPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeUndockPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeManageVolumePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeImpersonatePrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeCreateGlobalPrivilege	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: 33	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: 34	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: 35	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: 36	544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
Token: SeDebugPrivilege	4920	IpOverUsbSvrc.exe
Token: SeDebugPrivilege	4852	atiesrx.exe
Token: SeDebugPrivilege	4512	IpOverUsbSvrc.exe
Token: SeIncreaseQuotaPrivilege	3832	atiesrx.exe
Token: SeSecurityPrivilege	3832	atiesrx.exe
Token: SeTakeOwnershipPrivilege	3832	atiesrx.exe
Token: SeLoadDriverPrivilege	3832	atiesrx.exe
Token: SeSystemProfilePrivilege	3832	atiesrx.exe
Token: SeSystemtimePrivilege	3832	atiesrx.exe
Token: SeProfSingleProcessPrivilege	3832	atiesrx.exe
Token: SeIncBasePriorityPrivilege	3832	atiesrx.exe
Token: SeCreatePagefilePrivilege	3832	atiesrx.exe
Token: SeBackupPrivilege	3832	atiesrx.exe
Token: SeRestorePrivilege	3832	atiesrx.exe
Token: SeShutdownPrivilege	3832	atiesrx.exe
Token: SeDebugPrivilege	3832	atiesrx.exe
Token: SeSystemEnvironmentPrivilege	3832	atiesrx.exe
Token: SeChangeNotifyPrivilege	3832	atiesrx.exe
Token: SeRemoteShutdownPrivilege	3832	atiesrx.exe
Token: SeUndockPrivilege	3832	atiesrx.exe
Token: SeManageVolumePrivilege	3832	atiesrx.exe
Token: SeImpersonatePrivilege	3832	atiesrx.exe
Token: SeCreateGlobalPrivilege	3832	atiesrx.exe
Token: 33	3832	atiesrx.exe
Token: 34	3832	atiesrx.exe
Token: 35	3832	atiesrx.exe
Token: 36	3832	atiesrx.exe
Token: SeIncreaseQuotaPrivilege	2544	atiesrx.exe
Token: SeSecurityPrivilege	2544	atiesrx.exe
Token: SeTakeOwnershipPrivilege	2544	atiesrx.exe
Token: SeLoadDriverPrivilege	2544	atiesrx.exe
Token: SeSystemProfilePrivilege	2544	atiesrx.exe
Token: SeSystemtimePrivilege	2544	atiesrx.exe
Token: SeProfSingleProcessPrivilege	2544	atiesrx.exe
Token: SeIncBasePriorityPrivilege	2544	atiesrx.exe
Token: SeCreatePagefilePrivilege	2544	atiesrx.exe
Token: SeBackupPrivilege	2544	atiesrx.exe
Token: SeRestorePrivilege	2544	atiesrx.exe
Token: SeShutdownPrivilege	2544	atiesrx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe

pid process

544 de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe

pid	process
544	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exeIpOverUsbSvrc.exeatiesrx.exe

description	pid	process	target process
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 544	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
PID 2312 wrote to memory of 4920	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	IpOverUsbSvrc.exe
PID 2312 wrote to memory of 4920	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	IpOverUsbSvrc.exe
PID 2312 wrote to memory of 4920	2312	de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe	IpOverUsbSvrc.exe
PID 4920 wrote to memory of 4852	4920	IpOverUsbSvrc.exe	atiesrx.exe
PID 4920 wrote to memory of 4852	4920	IpOverUsbSvrc.exe	atiesrx.exe
PID 4920 wrote to memory of 4852	4920	IpOverUsbSvrc.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2296	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 4512	4852	atiesrx.exe	IpOverUsbSvrc.exe
PID 4852 wrote to memory of 4512	4852	atiesrx.exe	IpOverUsbSvrc.exe
PID 4852 wrote to memory of 4512	4852	atiesrx.exe	IpOverUsbSvrc.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 3832	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 2544	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe
PID 4852 wrote to memory of 1604	4852	atiesrx.exe	atiesrx.exe

C:\Users\Admin\AppData\Local\Temp\de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
"C:\Users\Admin\AppData\Local\Temp\de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Users\Admin\AppData\Local\Temp\de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe
"C:\Users\Admin\AppData\Local\Temp\de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:544

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 524
5⤵
- Program crash
PID:3840

C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1604

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2996

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2340

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3720

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1244

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4584

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:444

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2100

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4192

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 520
5⤵
- Program crash
PID:3440

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:5048

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 520
5⤵
- Program crash
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1904

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 520
5⤵
- Program crash
PID:1800

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4416

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:812

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3180

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3740

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 540
5⤵
- Program crash
PID:4516

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 536
5⤵
- Program crash
PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1952

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 528
5⤵
- Program crash
PID:2140

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 520
5⤵
- Program crash
PID:4488

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4420

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 520
5⤵
- Program crash
PID:4168

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 520
5⤵
- Program crash
PID:5052

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1552

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 524
5⤵
- Program crash
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2856

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3476

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 528
5⤵
- Program crash
PID:3140

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1536

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 528
5⤵
- Program crash
PID:480

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2032

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 520
5⤵
- Program crash
PID:1084

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1284

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1224

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:5116

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 524
5⤵
- Program crash
PID:4716

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3436

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4292

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4264

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:888

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 532
5⤵
- Program crash
PID:840

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3432

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 524
5⤵
- Program crash
PID:4556

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 520
5⤵
- Program crash
PID:2588

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:2864

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 532
5⤵
- Program crash
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 536
5⤵
- Program crash
PID:780

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:3052

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 520
5⤵
- Program crash
PID:4496

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
- Executes dropped EXE
PID:4088

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 520
5⤵
- Program crash
PID:2412

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4580

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3500

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 524
5⤵
- Program crash
PID:4076

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1088

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1432

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1896

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4940

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 520
5⤵
- Program crash
PID:3356

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4516

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4004

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5100

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3840

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:480

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3388

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3564

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3748

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3028

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5104

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1764

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4248

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3920

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1324

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1136

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2892

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3968

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 520
5⤵
- Program crash
PID:2872

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2268

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4944

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5072

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1836

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2600

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:556

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 532
5⤵
- Program crash
PID:2312

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3356

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1544

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2456

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2720

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:960

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:424

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1660

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3196

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 520
5⤵
- Program crash
PID:4520

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 532
5⤵
- Program crash
PID:4168

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:364

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3456

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4216

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3784

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5092

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4076

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4576

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:840

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:380

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3676

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 520
5⤵
- Program crash
PID:3336

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3424

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1820

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3012

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3004

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:716

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1172

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 520
5⤵
- Program crash
PID:3372

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1212

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 532
5⤵
- Program crash
PID:920

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:392

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 536
5⤵
- Program crash
PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 520
5⤵
- Program crash
PID:3336

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1292

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:520

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:780

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1480

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3572

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4052

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4480

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3132

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2712

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1412

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:732

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3404

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5024

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4256

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4260

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2312

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 520
5⤵
- Program crash
PID:776

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4484

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4916

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3264

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4452

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3172

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4572

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3624

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2372

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 520
5⤵
- Program crash
PID:4920

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4504

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1704

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3568

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1732

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4488

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4320

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1828

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2264

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 528
5⤵
- Program crash
PID:2424

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 520
5⤵
- Program crash
PID:1512

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3092

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 520
5⤵
- Program crash
PID:4016

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 532
5⤵
- Program crash
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 536
5⤵
- Program crash
PID:1684

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 528
5⤵
- Program crash
PID:1084

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3864

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:820

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1944

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 528
5⤵
- Program crash
PID:2552

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 520
5⤵
- Program crash
PID:2152

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1444

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 528
5⤵
- Program crash
PID:2984

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1232

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1744

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 520
5⤵
- Program crash
PID:1300

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 532
5⤵
- Program crash
PID:2116

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1144

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3464

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1712

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 520
5⤵
- Program crash
PID:3048

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2368

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3384

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 520
5⤵
- Program crash
PID:4072

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3280

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 520
5⤵
- Program crash
PID:4124

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4272

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:432

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 520
5⤵
- Program crash
PID:4208

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 528
5⤵
- Program crash
PID:3688

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 520
5⤵
- Program crash
PID:2212

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4724

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2348

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 528
5⤵
- Program crash
PID:2212

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3552

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4464

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4208

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4848

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 516
5⤵
- Program crash
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 520
5⤵
- Program crash
PID:4592

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:516

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 532
5⤵
- Program crash
PID:2484

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3364

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 520
5⤵
- Program crash
PID:1300

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:3780

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 532
5⤵
- Program crash
PID:3244

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4856

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2788

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 520
5⤵
- Program crash
PID:3244

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 520
5⤵
- Program crash
PID:1004

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1300

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1396

C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"
4⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 536
5⤵
- Program crash
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2296 -ip 2296
1⤵
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3992 -ip 3992
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1456 -ip 1456
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2776 -ip 2776
1⤵
PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4680 -ip 4680
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3868 -ip 3868
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3148 -ip 3148
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1196 -ip 1196
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1600 -ip 1600
1⤵
PID:820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3872 -ip 3872
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2352 -ip 2352
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3068 -ip 3068
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 408 -ip 408
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3088 -ip 3088
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 860 -ip 860
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 772 -ip 772
1⤵
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1708 -ip 1708
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2444 -ip 2444
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1624 -ip 1624
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1624 -ip 1624
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4760 -ip 4760
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 3704 -ip 3704
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 976 -ip 976
1⤵
PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 3988 -ip 3988
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4044 -ip 4044
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 4476 -ip 4476
1⤵
PID:2952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4908 -ip 4908
1⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3760 -ip 3760
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3524 -ip 3524
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1180 -ip 1180
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4340 -ip 4340
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3556 -ip 3556
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1408 -ip 1408
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 4636 -ip 4636
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3492 -ip 3492
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1716 -ip 1716
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4752 -ip 4752
1⤵
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4720 -ip 4720
1⤵
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4928 -ip 4928
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4928 -ip 4928
1⤵
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2952 -ip 2952
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 5036 -ip 5036
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 936 -p 4920 -ip 4920
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 4168 -ip 4168
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 2696 -ip 2696
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 4496 -ip 4496
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1192 -ip 1192
1⤵
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 2592 -ip 2592
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2052 -ip 2052
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 776 -ip 776
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 1308 -ip 1308
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 920 -ip 920
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 1844 -ip 1844
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2212 -ip 2212
1⤵
PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 2212 -ip 2212
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4072 -ip 4072
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4592 -ip 4592
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 2984 -ip 2984
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2484 -ip 2484
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4912 -ip 4912
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1692 -ip 1692
1⤵
PID:3244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\IpOverUsbSvrc.exe.log
Filesize
224B

MD5
c19eb8c8e7a40e6b987f9d2ee952996e

SHA1
6fc3049855bc9100643e162511673c6df0f28bfb

SHA256
677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

SHA512
860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe
Filesize
8KB

MD5
54fbde415453f5c9089b49e65bd5f8e7

SHA1
d77b86631f629b52bbebc6e08fbf60c78e8ceab0

SHA256
7d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf

SHA512
90dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe
Filesize
742KB

MD5
62bc51bab1e9d1c1e3814941aa1314aa

SHA1
92a9d44ca0603f5e88ce61deb3bc1c45f77082b5

SHA256
de3bb4242c91de7356b088b6986aba04e3fef7a678da279e1688e13f74ccc781

SHA512
b901017948516db6a4ff0902fa79bfd314089238281b20a8cb103d76679b1ac02e37e192e17044edbc408e49855ae1bc448be177487d47b7cabcde799404a218

Download Submit
memory/408-496-0x0000000000000000-mapping.dmp

Download
memory/444-227-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/444-222-0x0000000000000000-mapping.dmp

Download
memory/544-134-0x0000000000000000-mapping.dmp

Download
memory/544-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/772-601-0x0000000000000000-mapping.dmp

Download
memory/812-309-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/812-304-0x0000000000000000-mapping.dmp

Download
memory/860-550-0x0000000000000000-mapping.dmp

Download
memory/864-679-0x0000000000000000-mapping.dmp

Download
memory/864-683-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/888-594-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/888-589-0x0000000000000000-mapping.dmp

Download
memory/1088-739-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1196-379-0x0000000000000000-mapping.dmp

Download
memory/1224-538-0x0000000000000000-mapping.dmp

Download
memory/1224-543-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1244-209-0x0000000000000000-mapping.dmp

Download
memory/1244-214-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1284-532-0x0000000000000000-mapping.dmp

Download
memory/1284-537-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1432-743-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1456-262-0x0000000000000000-mapping.dmp

Download
memory/1536-490-0x0000000000000000-mapping.dmp

Download
memory/1536-495-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1552-436-0x0000000000000000-mapping.dmp

Download
memory/1552-441-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1600-406-0x0000000000000000-mapping.dmp

Download
memory/1604-189-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1604-184-0x0000000000000000-mapping.dmp

Download
memory/1624-659-0x0000000000000000-mapping.dmp

Download
memory/1708-622-0x0000000000000000-mapping.dmp

Download
memory/1896-747-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1904-282-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1904-277-0x0000000000000000-mapping.dmp

Download
memory/1952-357-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1952-352-0x0000000000000000-mapping.dmp

Download
memory/2032-516-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2032-511-0x0000000000000000-mapping.dmp

Download
memory/2100-233-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2100-228-0x0000000000000000-mapping.dmp

Download
memory/2296-166-0x0000000000930000-0x00000000009E2000-memory.dmp

Filesize
712KB

Download
memory/2296-152-0x0000000000000000-mapping.dmp

Download
memory/2296-160-0x0000000000930000-0x00000000009E2000-memory.dmp

Filesize
712KB

Download
memory/2296-165-0x0000000000930000-0x00000000009E2000-memory.dmp

Filesize
712KB

Download
memory/2304-363-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2304-358-0x0000000000000000-mapping.dmp

Download
memory/2312-132-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/2312-150-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/2312-133-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/2340-202-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2340-197-0x0000000000000000-mapping.dmp

Download
memory/2352-442-0x0000000000000000-mapping.dmp

Download
memory/2444-637-0x0000000000000000-mapping.dmp

Download
memory/2544-178-0x0000000000000000-mapping.dmp

Download
memory/2544-183-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2692-588-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2692-583-0x0000000000000000-mapping.dmp

Download
memory/2776-283-0x0000000000000000-mapping.dmp

Download
memory/2856-457-0x0000000000000000-mapping.dmp

Download
memory/2856-462-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2864-657-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2864-652-0x0000000000000000-mapping.dmp

Download
memory/2864-658-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2896-484-0x0000000000000000-mapping.dmp

Download
memory/2896-489-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2996-196-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2996-195-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2996-190-0x0000000000000000-mapping.dmp

Download
memory/3052-678-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3052-674-0x0000000000000000-mapping.dmp

Download
memory/3068-469-0x0000000000000000-mapping.dmp

Download
memory/3088-517-0x0000000000000000-mapping.dmp

Download
memory/3148-364-0x0000000000000000-mapping.dmp

Download
memory/3180-315-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3180-310-0x0000000000000000-mapping.dmp

Download
memory/3432-621-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3432-616-0x0000000000000000-mapping.dmp

Download
memory/3436-570-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3436-565-0x0000000000000000-mapping.dmp

Download
memory/3476-463-0x0000000000000000-mapping.dmp

Download
memory/3476-468-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3500-722-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3720-208-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3720-203-0x0000000000000000-mapping.dmp

Download
memory/3740-316-0x0000000000000000-mapping.dmp

Download
memory/3740-321-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3832-177-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3832-172-0x0000000000000000-mapping.dmp

Download
memory/3868-337-0x0000000000000000-mapping.dmp

Download
memory/3872-421-0x0000000000000000-mapping.dmp

Download
memory/3992-253-0x0000000000500000-0x00000000005B2000-memory.dmp

Filesize
712KB

Download
memory/3992-248-0x0000000000500000-0x00000000005B2000-memory.dmp

Filesize
712KB

Download
memory/3992-254-0x0000000000500000-0x00000000005B2000-memory.dmp

Filesize
712KB

Download
memory/3992-240-0x0000000000000000-mapping.dmp

Download
memory/4004-772-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4088-701-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4192-239-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4192-234-0x0000000000000000-mapping.dmp

Download
memory/4264-582-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4264-577-0x0000000000000000-mapping.dmp

Download
memory/4292-571-0x0000000000000000-mapping.dmp

Download
memory/4292-576-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4416-303-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4416-298-0x0000000000000000-mapping.dmp

Download
memory/4420-400-0x0000000000000000-mapping.dmp

Download
memory/4420-405-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4512-167-0x0000000000000000-mapping.dmp

Download
memory/4512-171-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4512-255-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4516-768-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4580-718-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4584-221-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4584-220-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4584-215-0x0000000000000000-mapping.dmp

Download
memory/4680-322-0x0000000000000000-mapping.dmp

Download
memory/4760-684-0x0000000000000000-mapping.dmp

Download
memory/4852-146-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4852-142-0x0000000000000000-mapping.dmp

Download
memory/4852-149-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4920-148-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4920-145-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4920-139-0x0000000000000000-mapping.dmp

Download
memory/4920-151-0x0000000074AA0000-0x0000000075051000-memory.dmp

Filesize
5.7MB

Download
memory/4940-751-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5048-261-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5048-256-0x0000000000000000-mapping.dmp

Download
memory/5056-595-0x0000000000000000-mapping.dmp

Download
memory/5056-600-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5108-399-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5108-394-0x0000000000000000-mapping.dmp

Download
memory/5116-549-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5116-544-0x0000000000000000-mapping.dmp

Download