Analysis
-
max time kernel
36s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-01-2024 01:22
Behavioral task
behavioral1
Sample
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe
Resource
win7-20231215-en
General
-
Target
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe
-
Size
918KB
-
MD5
beff93c13a3839484a3248f3a1702516
-
SHA1
77d2620d977c1b7730a599da82efd7360898f309
-
SHA256
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca
-
SHA512
fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28
-
SSDEEP
24576:k1I4MROxnFi3ArIrZlI0AilFEvxHi18D:k1rMioAMrZlI0AilFEvxHi
Malware Config
Extracted
orcus
Hack
127.0.0.1:10134
d7904e4fe3184c208642abe8f5cf9293
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
C:\Windows\System32\tаskmgr.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
GoogleUpdateTaskMachine
-
watchdog_path
AppData\smss.exe
Signatures
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule C:\Windows\System32\tаskmgr.exe family_orcus -
Orcurs Rat Executable 3 IoCs
Processes:
resource yara_rule C:\Windows\System32\tаskmgr.exe orcus behavioral1/memory/2704-34-0x00000000009F0000-0x0000000000ADC000-memory.dmp orcus behavioral1/memory/2652-104-0x000000001AF60000-0x000000001AFE0000-memory.dmp orcus -
Executes dropped EXE 64 IoCs
Processes:
tаskmgr.exesmss.exetаskmgr.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exeWerFault.exesmss.exeWerFault.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exepid process 2704 tаskmgr.exe 2248 smss.exe 2652 tаskmgr.exe 2688 smss.exe 1248 smss.exe 1612 smss.exe 1728 smss.exe 1832 smss.exe 2796 smss.exe 2052 smss.exe 2140 WerFault.exe 1760 smss.exe 2348 smss.exe 1336 smss.exe 1712 WerFault.exe 2128 smss.exe 1160 WerFault.exe 1808 smss.exe 2992 smss.exe 2428 smss.exe 2748 WerFault.exe 2728 smss.exe 2400 smss.exe 2916 smss.exe 1264 smss.exe 764 smss.exe 2984 smss.exe 856 smss.exe 336 smss.exe 1728 smss.exe 1720 smss.exe 2988 smss.exe 1748 smss.exe 448 smss.exe 1916 WerFault.exe 2492 smss.exe 1800 smss.exe 2364 smss.exe 2852 smss.exe 2180 smss.exe 1352 smss.exe 1980 smss.exe 2308 WerFault.exe 2440 smss.exe 1548 smss.exe 712 smss.exe 604 smss.exe 960 smss.exe 296 smss.exe 1580 smss.exe 2352 smss.exe 1296 smss.exe 2212 smss.exe 1232 smss.exe 2708 WerFault.exe 2156 smss.exe 2476 smss.exe 988 smss.exe 3036 smss.exe 1800 smss.exe 920 smss.exe 1768 smss.exe 1384 smss.exe 1528 smss.exe -
Loads dropped DLL 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 1976 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe 452 WerFault.exe 452 WerFault.exe 452 WerFault.exe 452 WerFault.exe 452 WerFault.exe 840 WerFault.exe 840 WerFault.exe 840 WerFault.exe 840 WerFault.exe 840 WerFault.exe 1048 WerFault.exe 1048 WerFault.exe 1048 WerFault.exe 1048 WerFault.exe 1048 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 2344 WerFault.exe 1812 WerFault.exe 1812 WerFault.exe 1812 WerFault.exe 1812 WerFault.exe 1812 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2588 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe 2908 WerFault.exe 864 WerFault.exe 864 WerFault.exe 864 WerFault.exe 864 WerFault.exe 864 WerFault.exe 1392 WerFault.exe 1392 WerFault.exe 1392 WerFault.exe 1392 WerFault.exe -
Drops file in System32 directory 3 IoCs
Processes:
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exedescription ioc process File created C:\Windows\System32\tаskmgr.exe 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe File opened for modification C:\Windows\System32\tаskmgr.exe 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe File created C:\Windows\System32\tаskmgr.exe.config 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1976 2688 WerFault.exe smss.exe 2572 1612 WerFault.exe 1692 1832 WerFault.exe 452 2052 WerFault.exe 840 1760 WerFault.exe 2344 2128 WerFault.exe smss.exe 1048 1336 WerFault.exe 1812 1808 WerFault.exe 2676 2428 WerFault.exe smss.exe 2588 2728 WerFault.exe smss.exe 2908 2916 WerFault.exe smss.exe 1392 856 WerFault.exe 864 764 WerFault.exe 1512 1728 WerFault.exe smss.exe 2412 2988 WerFault.exe 2292 448 WerFault.exe 1940 2492 WerFault.exe smss.exe 1796 2364 WerFault.exe 1984 2180 WerFault.exe smss.exe 1204 1980 WerFault.exe smss.exe 2456 2440 WerFault.exe smss.exe 1712 712 WerFault.exe 1744 1580 WerFault.exe smss.exe 2692 1296 WerFault.exe smss.exe 1564 960 WerFault.exe smss.exe 1972 1232 WerFault.exe smss.exe 860 2156 WerFault.exe smss.exe 2436 988 WerFault.exe 948 1768 WerFault.exe smss.exe 2808 1528 WerFault.exe 1160 3064 WerFault.exe 320 1652 WerFault.exe smss.exe 2140 1800 WerFault.exe smss.exe 1960 916 WerFault.exe smss.exe 1996 564 WerFault.exe smss.exe 1604 2056 WerFault.exe 2708 2472 WerFault.exe 816 2272 WerFault.exe smss.exe 2880 2124 WerFault.exe smss.exe 2888 1244 WerFault.exe 2308 2992 WerFault.exe smss.exe 1844 1384 WerFault.exe smss.exe 1316 984 WerFault.exe smss.exe 2568 1500 WerFault.exe smss.exe 1916 1928 WerFault.exe 3296 3248 WerFault.exe smss.exe 3176 3132 WerFault.exe smss.exe 300 1284 WerFault.exe smss.exe 1756 2112 WerFault.exe smss.exe 3396 3352 WerFault.exe smss.exe 3848 3812 WerFault.exe 3948 3908 WerFault.exe smss.exe 3724 3688 WerFault.exe smss.exe 3604 3560 WerFault.exe smss.exe 3500 3464 WerFault.exe smss.exe 2216 3284 WerFault.exe 3144 1948 WerFault.exe smss.exe 4052 4020 WerFault.exe smss.exe 876 3392 WerFault.exe smss.exe 3528 3444 WerFault.exe 3732 3584 WerFault.exe 3964 3864 WerFault.exe smss.exe 4012 2860 WerFault.exe smss.exe 1484 3108 WerFault.exe smss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tаskmgr.exepid process 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe 2704 tаskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tаskmgr.exepid process 2704 tаskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tаskmgr.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exeWerFault.exeWerFault.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exeWerFault.exeWerFault.exesmss.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exesmss.exeWerFault.exesmss.exesmss.exesmss.exedescription pid process Token: SeDebugPrivilege 2704 tаskmgr.exe Token: SeDebugPrivilege 2248 smss.exe Token: SeDebugPrivilege 1248 smss.exe Token: SeDebugPrivilege 1728 smss.exe Token: SeDebugPrivilege 2796 smss.exe Token: SeDebugPrivilege 2140 WerFault.exe Token: SeDebugPrivilege 2348 smss.exe Token: SeDebugPrivilege 1712 WerFault.exe Token: SeDebugPrivilege 1160 WerFault.exe Token: SeDebugPrivilege 2992 smss.exe Token: SeDebugPrivilege 2748 WerFault.exe Token: SeDebugPrivilege 2400 smss.exe Token: SeDebugPrivilege 1264 smss.exe Token: SeDebugPrivilege 2984 smss.exe Token: SeDebugPrivilege 336 smss.exe Token: SeDebugPrivilege 1720 smss.exe Token: SeDebugPrivilege 1748 smss.exe Token: SeDebugPrivilege 1916 WerFault.exe Token: SeDebugPrivilege 1800 smss.exe Token: SeDebugPrivilege 2852 smss.exe Token: SeDebugPrivilege 1352 smss.exe Token: SeDebugPrivilege 2308 WerFault.exe Token: SeDebugPrivilege 1548 smss.exe Token: SeDebugPrivilege 604 smss.exe Token: SeDebugPrivilege 296 smss.exe Token: SeDebugPrivilege 2352 smss.exe Token: SeDebugPrivilege 2212 smss.exe Token: SeDebugPrivilege 2708 WerFault.exe Token: SeDebugPrivilege 2476 smss.exe Token: SeDebugPrivilege 3036 smss.exe Token: SeDebugPrivilege 920 smss.exe Token: SeDebugPrivilege 1384 smss.exe Token: SeDebugPrivilege 1944 smss.exe Token: SeDebugPrivilege 2800 smss.exe Token: SeDebugPrivilege 2308 WerFault.exe Token: SeDebugPrivilege 984 smss.exe Token: SeDebugPrivilege 1784 smss.exe Token: SeDebugPrivilege 2680 smss.exe Token: SeDebugPrivilege 2852 smss.exe Token: SeDebugPrivilege 1600 smss.exe Token: SeDebugPrivilege 684 smss.exe Token: SeDebugPrivilege 1720 smss.exe Token: SeDebugPrivilege 1932 smss.exe Token: SeDebugPrivilege 1352 smss.exe Token: SeDebugPrivilege 1700 WerFault.exe Token: SeDebugPrivilege 1304 smss.exe Token: SeDebugPrivilege 684 smss.exe Token: SeDebugPrivilege 2720 WerFault.exe Token: SeDebugPrivilege 3100 WerFault.exe Token: SeDebugPrivilege 3224 smss.exe Token: SeDebugPrivilege 3328 smss.exe Token: SeDebugPrivilege 3436 smss.exe Token: SeDebugPrivilege 3532 smss.exe Token: SeDebugPrivilege 3660 smss.exe Token: SeDebugPrivilege 3764 WerFault.exe Token: SeDebugPrivilege 3876 smss.exe Token: SeDebugPrivilege 3996 smss.exe Token: SeDebugPrivilege 4092 smss.exe Token: SeDebugPrivilege 3212 smss.exe Token: SeDebugPrivilege 3340 WerFault.exe Token: SeDebugPrivilege 2720 WerFault.exe Token: SeDebugPrivilege 3644 smss.exe Token: SeDebugPrivilege 1968 smss.exe Token: SeDebugPrivilege 3892 smss.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
tаskmgr.exepid process 2704 tаskmgr.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
tаskmgr.exepid process 2704 tаskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.execsc.exetаskmgr.exetaskeng.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exesmss.exedescription pid process target process PID 2064 wrote to memory of 1780 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe csc.exe PID 2064 wrote to memory of 1780 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe csc.exe PID 2064 wrote to memory of 1780 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe csc.exe PID 1780 wrote to memory of 1540 1780 csc.exe cvtres.exe PID 1780 wrote to memory of 1540 1780 csc.exe cvtres.exe PID 1780 wrote to memory of 1540 1780 csc.exe cvtres.exe PID 2064 wrote to memory of 2704 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe tаskmgr.exe PID 2064 wrote to memory of 2704 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe tаskmgr.exe PID 2064 wrote to memory of 2704 2064 1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe tаskmgr.exe PID 2704 wrote to memory of 2248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2248 2704 tаskmgr.exe smss.exe PID 2616 wrote to memory of 2652 2616 taskeng.exe tаskmgr.exe PID 2616 wrote to memory of 2652 2616 taskeng.exe tаskmgr.exe PID 2616 wrote to memory of 2652 2616 taskeng.exe tаskmgr.exe PID 2248 wrote to memory of 2688 2248 smss.exe smss.exe PID 2248 wrote to memory of 2688 2248 smss.exe smss.exe PID 2248 wrote to memory of 2688 2248 smss.exe smss.exe PID 2248 wrote to memory of 2688 2248 smss.exe smss.exe PID 2688 wrote to memory of 1976 2688 smss.exe WerFault.exe PID 2688 wrote to memory of 1976 2688 smss.exe WerFault.exe PID 2688 wrote to memory of 1976 2688 smss.exe WerFault.exe PID 2688 wrote to memory of 1976 2688 smss.exe WerFault.exe PID 2704 wrote to memory of 1248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1248 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1248 2704 tаskmgr.exe smss.exe PID 1248 wrote to memory of 1612 1248 smss.exe smss.exe PID 1248 wrote to memory of 1612 1248 smss.exe smss.exe PID 1248 wrote to memory of 1612 1248 smss.exe smss.exe PID 1248 wrote to memory of 1612 1248 smss.exe smss.exe PID 1612 wrote to memory of 2572 1612 smss.exe WerFault.exe PID 1612 wrote to memory of 2572 1612 smss.exe WerFault.exe PID 1612 wrote to memory of 2572 1612 smss.exe WerFault.exe PID 1612 wrote to memory of 2572 1612 smss.exe WerFault.exe PID 2704 wrote to memory of 1728 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1728 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1728 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 1728 2704 tаskmgr.exe smss.exe PID 1728 wrote to memory of 1832 1728 smss.exe smss.exe PID 1728 wrote to memory of 1832 1728 smss.exe smss.exe PID 1728 wrote to memory of 1832 1728 smss.exe smss.exe PID 1728 wrote to memory of 1832 1728 smss.exe smss.exe PID 1832 wrote to memory of 1692 1832 smss.exe WerFault.exe PID 1832 wrote to memory of 1692 1832 smss.exe WerFault.exe PID 1832 wrote to memory of 1692 1832 smss.exe WerFault.exe PID 1832 wrote to memory of 1692 1832 smss.exe WerFault.exe PID 2704 wrote to memory of 2796 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2796 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2796 2704 tаskmgr.exe smss.exe PID 2704 wrote to memory of 2796 2704 tаskmgr.exe smss.exe PID 2796 wrote to memory of 2052 2796 smss.exe smss.exe PID 2796 wrote to memory of 2052 2796 smss.exe smss.exe PID 2796 wrote to memory of 2052 2796 smss.exe smss.exe PID 2796 wrote to memory of 2052 2796 smss.exe smss.exe PID 2052 wrote to memory of 452 2052 smss.exe WerFault.exe PID 2052 wrote to memory of 452 2052 smss.exe WerFault.exe PID 2052 wrote to memory of 452 2052 smss.exe WerFault.exe PID 2052 wrote to memory of 452 2052 smss.exe WerFault.exe PID 2704 wrote to memory of 2140 2704 tаskmgr.exe WerFault.exe PID 2704 wrote to memory of 2140 2704 tаskmgr.exe WerFault.exe PID 2704 wrote to memory of 2140 2704 tаskmgr.exe WerFault.exe PID 2704 wrote to memory of 2140 2704 tаskmgr.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe"C:\Users\Admin\AppData\Local\Temp\1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3yscipsr.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES147B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC147A.tmp"3⤵
-
C:\Windows\System32\tаskmgr.exe"C:\Windows\System32\tаskmgr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 5605⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 5564⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 5565⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 5525⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5565⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 5605⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 5564⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 5605⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 5565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 5564⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 5605⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 5565⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 5564⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 5565⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 5564⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 5565⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 5605⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 5645⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 5644⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 5605⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5288 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5764 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5516 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6208 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6860 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6656 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6892 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6504 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6720 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6728 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7192 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7460 -s 5565⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 5604⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7800 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8024 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8132 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7432 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7584 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7376 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7876 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7996 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7648 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7232 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7780 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7532 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8196 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8424 -s 5445⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8556 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8676 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8808 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8920 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9056 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9164 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8332 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8640 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8788 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8380 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9148 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9024 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8880 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9016 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8280 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8876 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8932 -s 5645⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9308 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9408 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9680 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9800 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9904 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10012 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10132 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9236 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9324 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9500 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9836 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9968 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10200 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9336 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9376 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9888 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9832 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9868 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9232 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10080 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10328 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10452 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10612 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10724 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10856 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10960 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11104 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11200 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9784 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10304 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10620 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10832 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11092 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11208 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10512 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10672 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11124 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11196 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10608 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10924 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10348 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10988 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10472 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10664 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10936 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11112 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10440 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7324 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10676 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10500 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7264 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 5685⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8352 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8008 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8040 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10448 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7616 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7748 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 5565⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7720 -s 5605⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /launchSelfAndExit "C:\Windows\System32\tаskmgr.exe" 2704 /protectFile3⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9632 -s 5565⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {875019F5-9068-4BBC-BACA-A9A23068B8A5} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\tаskmgr.exeC:\Windows\System32\tаskmgr.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 5562⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 5601⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 5561⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 5361⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 5561⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 5561⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 5642⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 5562⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 5561⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 5561⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 5561⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 5562⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 5561⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 5601⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 5602⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3908 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3284 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 5562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 5561⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 5561⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 5562⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 5601⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 5602⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 5602⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 5601⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 5602⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 5562⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 5602⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 5601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 5401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 5601⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 5601⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5424 -s 5601⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 5602⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5740 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 5601⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5436 -s 5602⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 5601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6440 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 5562⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 5642⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6464 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6972 -s 5562⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7696 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7604 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7912 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 5601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 5561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8076 -s 5561⤵
-
C:\Users\Admin\AppData\Roaming\smss.exe"C:\Users\Admin\AppData\Roaming\smss.exe" /watchProcess "C:\Windows\System32\tаskmgr.exe" 2704 "/protectFile"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9188 -s 5602⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3yscipsr.dllFilesize
76KB
MD5db4d8d03bf32ef380b687e1973906105
SHA16da85180a7c700d28e668aeea225c1ef90e156e5
SHA256948798353418d4eb05dad55826c36e6ee7688176ac840a9511d2a63111a46f42
SHA51200e59f598fd61e13a30cb0ec09b17e3b81bbf8674d2c5b2c6078daa490863e30630ff3d08d65450267c0227eebeef27f4e71f0117ddb0ae1ac3c41af621ff3f9
-
C:\Users\Admin\AppData\Local\Temp\RES147B.tmpFilesize
1KB
MD52a707ea8ea9c6f99ae6ed44e80691f90
SHA195e426cde19228d2d32808db3d8bfb8902482534
SHA25645d09a01a739c30ed49459eff324ba1f3da31097100c510489da71e5b0c8abeb
SHA5127bb039403089fbcb08459faabf4770586f1e2cacdc9c1205c54a6e04577c0e447627e585f46feb175de0f348c91c2360faf748384345dcd39a22bd3470c277a0
-
C:\Users\Admin\AppData\Local\Temp\err_d7904e4fe3184c208642abe8f5cf9293.datFilesize
1KB
MD59ebfc4dcf5de3201590415767048658a
SHA1f54762badea9985734058ba8e8f6559ec5d8e890
SHA2565ddcebf1d46d24f55451a0990ca8f8f1f12555c47408d9fb9b1823527eccf515
SHA512d265b5e7f636158dc1335268794c3aa08d65108f2e7d60ab6f68428391b9d3eba8ecdcf4cde5a4fb37b05688953edab995ffef51f845d8758c9fbf010f5b1ccf
-
C:\Users\Admin\AppData\Roaming\smss.exeFilesize
9KB
MD5913967b216326e36a08010fb70f9dba3
SHA17b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf
SHA2568d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
SHA512c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33
-
C:\Windows\System32\tаskmgr.exeFilesize
918KB
MD5beff93c13a3839484a3248f3a1702516
SHA177d2620d977c1b7730a599da82efd7360898f309
SHA2561407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca
SHA512fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28
-
C:\Windows\System32\tаskmgr.exe.configFilesize
357B
MD5a2b76cea3a59fa9af5ea21ff68139c98
SHA135d76475e6a54c168f536e30206578babff58274
SHA256f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839
SHA512b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad
-
\??\c:\Users\Admin\AppData\Local\Temp\3yscipsr.0.csFilesize
208KB
MD56011503497b1b9250a05debf9690e52c
SHA1897aea61e9bffc82d7031f1b3da12fb83efc6d82
SHA25608f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434
SHA512604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9
-
\??\c:\Users\Admin\AppData\Local\Temp\3yscipsr.cmdlineFilesize
349B
MD51eb49b255e83e0a49670f8fbe7d5f6ee
SHA1a8cc79157df15318f9ee829263cc36b4ec437f71
SHA256a564487bef319f1f19c7b6b6708c1ea4037b42d60f5c62a084bcf701de67365e
SHA5129ecd39cac9a83e9cba9629076f34febc9b188758637577fc2343ea923d5283a24a9b1cc881ed87b19d6af7f1a781c4b8abef35699574bd8531d147587f7a00a3
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC147A.tmpFilesize
676B
MD5b0ee3de7ec6fed662419f85ee9f30d05
SHA1fff5ec73b6fc14c33e651e7027970814e894b9d9
SHA25660f7e95011e32e0c720424a4e12a62eab2120174d3139f29834b31936ce4db7b
SHA5124060d6a2d3fb610d1dd393f367e7de790fed3269ebe389db9105ff80a3fb139d492cba6edb31be75df762f974123a43ac57935a722bfd13ebf51b9dbfb6af422
-
memory/1160-134-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1160-136-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1248-67-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1248-69-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1336-120-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1612-77-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1612-70-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1712-123-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1712-126-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1728-80-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1760-145-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1760-110-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/1808-140-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1808-137-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/1832-86-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2052-91-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2064-2-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmpFilesize
9.6MB
-
memory/2064-0-0x000000001AEC0000-0x000000001AF1C000-memory.dmpFilesize
368KB
-
memory/2064-27-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB
-
memory/2064-17-0x000000001AF20000-0x000000001AF36000-memory.dmpFilesize
88KB
-
memory/2064-22-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB
-
memory/2064-20-0x0000000000BD0000-0x0000000000BD8000-memory.dmpFilesize
32KB
-
memory/2064-32-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmpFilesize
9.6MB
-
memory/2064-21-0x0000000000C00000-0x0000000000C08000-memory.dmpFilesize
32KB
-
memory/2064-19-0x00000000005D0000-0x00000000005E2000-memory.dmpFilesize
72KB
-
memory/2064-1-0x00000000005A0000-0x00000000005AE000-memory.dmpFilesize
56KB
-
memory/2064-4-0x000007FEF5AE0000-0x000007FEF647D000-memory.dmpFilesize
9.6MB
-
memory/2064-3-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB
-
memory/2128-133-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2128-125-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2140-103-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2140-100-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2248-59-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2248-57-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2248-53-0x0000000001340000-0x0000000001348000-memory.dmpFilesize
32KB
-
memory/2348-112-0x0000000001340000-0x0000000001348000-memory.dmpFilesize
32KB
-
memory/2348-111-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2348-115-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2428-141-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2428-143-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2652-55-0x000000001AF60000-0x000000001AFE0000-memory.dmpFilesize
512KB
-
memory/2652-147-0x000007FEECF10000-0x000007FEED8FC000-memory.dmpFilesize
9.9MB
-
memory/2652-104-0x000000001AF60000-0x000000001AFE0000-memory.dmpFilesize
512KB
-
memory/2652-102-0x000007FEECF10000-0x000007FEED8FC000-memory.dmpFilesize
9.9MB
-
memory/2652-54-0x000007FEECF10000-0x000007FEED8FC000-memory.dmpFilesize
9.9MB
-
memory/2688-66-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2688-58-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2704-42-0x00000000021A0000-0x00000000021B0000-memory.dmpFilesize
64KB
-
memory/2704-36-0x000000001AF90000-0x000000001B010000-memory.dmpFilesize
512KB
-
memory/2704-88-0x000000001AF90000-0x000000001B010000-memory.dmpFilesize
512KB
-
memory/2704-45-0x000000001AF90000-0x000000001B010000-memory.dmpFilesize
512KB
-
memory/2704-34-0x00000000009F0000-0x0000000000ADC000-memory.dmpFilesize
944KB
-
memory/2704-93-0x000000001AF90000-0x000000001B010000-memory.dmpFilesize
512KB
-
memory/2704-41-0x000000001AF90000-0x000000001B010000-memory.dmpFilesize
512KB
-
memory/2704-40-0x0000000002180000-0x0000000002198000-memory.dmpFilesize
96KB
-
memory/2704-39-0x0000000000630000-0x000000000067E000-memory.dmpFilesize
312KB
-
memory/2704-79-0x000007FEECF10000-0x000007FEED8FC000-memory.dmpFilesize
9.9MB
-
memory/2704-35-0x000007FEECF10000-0x000007FEED8FC000-memory.dmpFilesize
9.9MB
-
memory/2728-146-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2748-144-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2796-92-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2796-90-0x0000000074910000-0x0000000074FFE000-memory.dmpFilesize
6.9MB
-
memory/2992-142-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB
-
memory/2992-139-0x00000000748C0000-0x0000000074FAE000-memory.dmpFilesize
6.9MB