Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
04-04-2024 07:24
Behavioral task
behavioral1
Sample
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe
Resource
win10v2004-20240319-en
General
-
Target
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe
-
Size
483KB
-
MD5
c16b61d355597e973962354a54d9105a
-
SHA1
418f9f2d76cc53b40f6f7321f93bff947af7a699
-
SHA256
a1f0f4676e135cc88ab8b6a25c70530fa193b1718bd2ba7b6ac1c997c241f6c8
-
SHA512
9e4ede43e4cce4a0312cb52a795bf04bf75b7f5c8dfd837f47d86968db11febc92434d1aa71d88e785d3e99e12a99d997ce0edc9061fe2b380f82d03f7c7071e
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNH5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDicv
Malware Config
Extracted
remcos
RemoteHost
jansuri.kozow.com:7232
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3XBWOL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target Process procid_target 3180 3192 WerFault.exe 105 4600 372 WerFault.exe 104 2436 2440 WerFault.exe 107 2364 1216 WerFault.exe 117 5036 4260 WerFault.exe 116 4532 3780 WerFault.exe 119 4264 3016 WerFault.exe 125 3180 4588 WerFault.exe 128 3192 3376 WerFault.exe 126 4920 4996 WerFault.exe 135 3960 2948 WerFault.exe 136 2852 1000 WerFault.exe 138 2480 4692 WerFault.exe 145 1404 320 WerFault.exe 144 4724 4432 WerFault.exe 147 3960 3384 WerFault.exe 154 3276 1776 WerFault.exe 155 1000 3780 WerFault.exe 157 4116 4016 WerFault.exe 165 1788 1420 WerFault.exe 168 3092 4464 WerFault.exe 173 3144 1612 WerFault.exe 178 4872 1720 WerFault.exe 182 1392 4268 WerFault.exe 181 5108 4724 WerFault.exe 188 972 2364 WerFault.exe 191 1208 228 WerFault.exe 189 2576 4596 WerFault.exe 197 1360 436 WerFault.exe 201 3676 4492 WerFault.exe 200 -
Suspicious use of SetThreadContext 31 IoCs
Processes:
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exeiexplore.exedescription pid Process procid_target PID 4000 set thread context of 1084 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 95 PID 1084 set thread context of 372 1084 iexplore.exe 104 PID 1084 set thread context of 3192 1084 iexplore.exe 105 PID 1084 set thread context of 2440 1084 iexplore.exe 107 PID 1084 set thread context of 4260 1084 iexplore.exe 116 PID 1084 set thread context of 1216 1084 iexplore.exe 117 PID 1084 set thread context of 3780 1084 iexplore.exe 119 PID 1084 set thread context of 3016 1084 iexplore.exe 125 PID 1084 set thread context of 3376 1084 iexplore.exe 126 PID 1084 set thread context of 4588 1084 iexplore.exe 128 PID 1084 set thread context of 4996 1084 iexplore.exe 135 PID 1084 set thread context of 2948 1084 iexplore.exe 136 PID 1084 set thread context of 1000 1084 iexplore.exe 138 PID 1084 set thread context of 320 1084 iexplore.exe 144 PID 1084 set thread context of 4692 1084 iexplore.exe 145 PID 1084 set thread context of 4432 1084 iexplore.exe 147 PID 1084 set thread context of 3384 1084 iexplore.exe 154 PID 1084 set thread context of 1776 1084 iexplore.exe 155 PID 1084 set thread context of 3780 1084 iexplore.exe 157 PID 1084 set thread context of 4016 1084 iexplore.exe 165 PID 1084 set thread context of 1420 1084 iexplore.exe 168 PID 1084 set thread context of 4464 1084 iexplore.exe 173 PID 1084 set thread context of 1612 1084 iexplore.exe 178 PID 1084 set thread context of 4268 1084 iexplore.exe 181 PID 1084 set thread context of 1720 1084 iexplore.exe 182 PID 1084 set thread context of 4724 1084 iexplore.exe 188 PID 1084 set thread context of 228 1084 iexplore.exe 189 PID 1084 set thread context of 2364 1084 iexplore.exe 191 PID 1084 set thread context of 4596 1084 iexplore.exe 197 PID 1084 set thread context of 4492 1084 iexplore.exe 200 PID 1084 set thread context of 436 1084 iexplore.exe 201 -
Suspicious behavior: MapViewOfSection 39 IoCs
Processes:
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exeiexplore.exepid Process 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe 1084 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exeiexplore.exedescription pid Process procid_target PID 4000 wrote to memory of 1084 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 95 PID 4000 wrote to memory of 1084 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 95 PID 4000 wrote to memory of 1084 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 95 PID 4000 wrote to memory of 1084 4000 17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe 95 PID 1084 wrote to memory of 372 1084 iexplore.exe 104 PID 1084 wrote to memory of 372 1084 iexplore.exe 104 PID 1084 wrote to memory of 372 1084 iexplore.exe 104 PID 1084 wrote to memory of 372 1084 iexplore.exe 104 PID 1084 wrote to memory of 3192 1084 iexplore.exe 105 PID 1084 wrote to memory of 3192 1084 iexplore.exe 105 PID 1084 wrote to memory of 3192 1084 iexplore.exe 105 PID 1084 wrote to memory of 3192 1084 iexplore.exe 105 PID 1084 wrote to memory of 2440 1084 iexplore.exe 107 PID 1084 wrote to memory of 2440 1084 iexplore.exe 107 PID 1084 wrote to memory of 2440 1084 iexplore.exe 107 PID 1084 wrote to memory of 2440 1084 iexplore.exe 107 PID 1084 wrote to memory of 4260 1084 iexplore.exe 116 PID 1084 wrote to memory of 4260 1084 iexplore.exe 116 PID 1084 wrote to memory of 4260 1084 iexplore.exe 116 PID 1084 wrote to memory of 4260 1084 iexplore.exe 116 PID 1084 wrote to memory of 1216 1084 iexplore.exe 117 PID 1084 wrote to memory of 1216 1084 iexplore.exe 117 PID 1084 wrote to memory of 1216 1084 iexplore.exe 117 PID 1084 wrote to memory of 1216 1084 iexplore.exe 117 PID 1084 wrote to memory of 3780 1084 iexplore.exe 119 PID 1084 wrote to memory of 3780 1084 iexplore.exe 119 PID 1084 wrote to memory of 3780 1084 iexplore.exe 119 PID 1084 wrote to memory of 3780 1084 iexplore.exe 119 PID 1084 wrote to memory of 3016 1084 iexplore.exe 125 PID 1084 wrote to memory of 3016 1084 iexplore.exe 125 PID 1084 wrote to memory of 3016 1084 iexplore.exe 125 PID 1084 wrote to memory of 3016 1084 iexplore.exe 125 PID 1084 wrote to memory of 3376 1084 iexplore.exe 126 PID 1084 wrote to memory of 3376 1084 iexplore.exe 126 PID 1084 wrote to memory of 3376 1084 iexplore.exe 126 PID 1084 wrote to memory of 3376 1084 iexplore.exe 126 PID 1084 wrote to memory of 4588 1084 iexplore.exe 128 PID 1084 wrote to memory of 4588 1084 iexplore.exe 128 PID 1084 wrote to memory of 4588 1084 iexplore.exe 128 PID 1084 wrote to memory of 4588 1084 iexplore.exe 128 PID 1084 wrote to memory of 552 1084 iexplore.exe 134 PID 1084 wrote to memory of 552 1084 iexplore.exe 134 PID 1084 wrote to memory of 552 1084 iexplore.exe 134 PID 1084 wrote to memory of 4996 1084 iexplore.exe 135 PID 1084 wrote to memory of 4996 1084 iexplore.exe 135 PID 1084 wrote to memory of 4996 1084 iexplore.exe 135 PID 1084 wrote to memory of 4996 1084 iexplore.exe 135 PID 1084 wrote to memory of 2948 1084 iexplore.exe 136 PID 1084 wrote to memory of 2948 1084 iexplore.exe 136 PID 1084 wrote to memory of 2948 1084 iexplore.exe 136 PID 1084 wrote to memory of 2948 1084 iexplore.exe 136 PID 1084 wrote to memory of 1000 1084 iexplore.exe 138 PID 1084 wrote to memory of 1000 1084 iexplore.exe 138 PID 1084 wrote to memory of 1000 1084 iexplore.exe 138 PID 1084 wrote to memory of 1000 1084 iexplore.exe 138 PID 1084 wrote to memory of 320 1084 iexplore.exe 144 PID 1084 wrote to memory of 320 1084 iexplore.exe 144 PID 1084 wrote to memory of 320 1084 iexplore.exe 144 PID 1084 wrote to memory of 320 1084 iexplore.exe 144 PID 1084 wrote to memory of 4692 1084 iexplore.exe 145 PID 1084 wrote to memory of 4692 1084 iexplore.exe 145 PID 1084 wrote to memory of 4692 1084 iexplore.exe 145 PID 1084 wrote to memory of 4692 1084 iexplore.exe 145 PID 1084 wrote to memory of 4432 1084 iexplore.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\17122153850e49c0cfb850fba174cf16707d6542d13cef87fc72c790ae00b3df54faaaaed9126.dat-decoded.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kqgbvagnczyzemgkbypnwtmx"3⤵PID:372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 124⤵
- Program crash
PID:4600
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\usllwsqhqiqegsuosibohyggfwb"3⤵PID:3192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 124⤵
- Program crash
PID:3180
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wnyewlbieqiqqgrsbloqklbxolsdjz"3⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 124⤵
- Program crash
PID:2436
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rcmvtswurmmkchvycxc"3⤵PID:4260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 124⤵
- Program crash
PID:5036
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\besotkgnnuepfnjkmipckz"3⤵PID:1216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 124⤵
- Program crash
PID:2364
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\myfguurpbcwtptfodtjevduxi"3⤵PID:3780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 124⤵
- Program crash
PID:4532
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ihgiruoudhsadiyyn"3⤵PID:3016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 124⤵
- Program crash
PID:4264
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tjlbsmhwrpkeopmcxbxs"3⤵PID:3376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 124⤵
- Program crash
PID:3192
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ddrutfspfxcjqvigoljtcjho"3⤵PID:4588
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 124⤵
- Program crash
PID:3180
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ysnlpdebauhd"3⤵PID:552
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ysnlpdebauhd"3⤵PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 124⤵
- Program crash
PID:4920
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\inswqwpcoczhmcb"3⤵PID:2948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 124⤵
- Program crash
PID:3960
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lpxorozwckruoqxcilx"3⤵PID:1000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 124⤵
- Program crash
PID:2852
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fwtgnnu"3⤵PID:320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 124⤵
- Program crash
PID:1404
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pyyyofejepn"3⤵PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 124⤵
- Program crash
PID:2480
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\aseroypdrxfxnd"3⤵PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 124⤵
- Program crash
PID:4724
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xjftmp"3⤵PID:3384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 124⤵
- Program crash
PID:3960
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\heklmhfjp"3⤵PID:1776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 124⤵
- Program crash
PID:3276
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ryyenaqldsmn"3⤵PID:3780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 124⤵
- Program crash
PID:1000
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mnlvjhcwqoqgiglwoqgeviauotzjcynj"3⤵PID:1352
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mnlvjhcwqoqgiglwoqgeviauotzjcynj"3⤵PID:4016
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 124⤵
- Program crash
PID:4116
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\opzo"3⤵PID:2436
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\opzo"3⤵PID:1420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 124⤵
- Program crash
PID:1788
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjezljf"3⤵PID:4420
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjezljf"3⤵PID:2992
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjezljf"3⤵PID:1200
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zjezljf"3⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 124⤵
- Program crash
PID:3092
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tysqhqsdoberhbakpptsybsuqjf"3⤵PID:1612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 124⤵
- Program crash
PID:3144
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\esfjijdxcjwwjhwwzagubonlryonyl"3⤵PID:2680
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\esfjijdxcjwwjhwwzagubonlryonyl"3⤵PID:4268
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 124⤵
- Program crash
PID:1392
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gulbjbnyqrobtnkaqlbnmtauzegwrvfxo"3⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 124⤵
- Program crash
PID:4872
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lemlgsserwlhidckaibinggkt"3⤵PID:4724
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 124⤵
- Program crash
PID:5108
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vyrwgldfnedmsjzoktojqlabudlsl"3⤵PID:228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 124⤵
- Program crash
PID:1208
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yawohdozbmvrupnstdbdbynkdjvbeiyg"3⤵PID:2364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 124⤵
- Program crash
PID:972
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\spsgecikpjzkgqryuipw"3⤵PID:4596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 124⤵
- Program crash
PID:2576
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cjyyeutmdrrxqenkmsbxtmtb"3⤵PID:2484
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cjyyeutmdrrxqenkmsbxtmtb"3⤵PID:4492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 124⤵
- Program crash
PID:3676
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nddjfnefrzjctkbovdwzerosxib"3⤵PID:436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 124⤵
- Program crash
PID:1360
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 372 -ip 3721⤵PID:3780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3192 -ip 31921⤵PID:1576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2440 -ip 24401⤵PID:1348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4260 -ip 42601⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1216 -ip 12161⤵PID:4232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3780 -ip 37801⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3016 -ip 30161⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3376 -ip 33761⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4588 -ip 45881⤵PID:4628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4996 -ip 49961⤵PID:3716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2948 -ip 29481⤵PID:228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1000 -ip 10001⤵PID:2384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 320 -ip 3201⤵PID:4772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4692 -ip 46921⤵PID:2440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4432 -ip 44321⤵PID:3188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3384 -ip 33841⤵PID:4116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1776 -ip 17761⤵PID:2364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3780 -ip 37801⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4016 -ip 40161⤵PID:4628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1420 -ip 14201⤵PID:4044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4464 -ip 44641⤵PID:4132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1612 -ip 16121⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4268 -ip 42681⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1720 -ip 17201⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4724 -ip 47241⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 228 -ip 2281⤵PID:4920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2364 -ip 23641⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4596 -ip 45961⤵PID:1804
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4492 -ip 44921⤵PID:3780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 436 -ip 4361⤵PID:3192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:81⤵PID:4268