hawkeye_reborn | b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe
Size

575KB
MD5

8d897a409a231c4bdb21ac3bcf9118b1
SHA1

9cfdb5e97e24948e90fc2c6baa4aeb06ce091470
SHA256

b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492
SHA512

45fa5b7121b91cbe8860362c1b966cdc070611a04126b5455fa2e5e025c65559cdba03f4d0db0c5b7249e8905a8200323225f40ecab0f6c6d6953c66744d51aa
SSDEEP

12288:PK3aVsTejOAevrUSNhpO+CaDq+b3gAcAyqR3zhIin:PK3XeKNvwAjLCaDq+b3tjR3zhIQ

Score

10^/10

hawkeye_reborn keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
smtp.mail.ru
Port:
587
Username:
[email protected]
Password:
(#@jS%{GF;0

Mutex

51ca91c3-9a11-4443-9e61-ee6e5c097d44

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:(#@jS%{GF;0 _EmailPort:587 _EmailSSL:true _EmailServer:smtp.mail.ru _EmailUsername:[email protected] _ExecutionDelay:5 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:51ca91c3-9a11-4443-9e61-ee6e5c097d44 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:true _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1092-42-0x0000000007740000-0x00000000077B6000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1092-42-0x0000000007740000-0x00000000077B6000-memory.dmp	WebBrowserPassView

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/memory/1092-42-0x0000000007740000-0x00000000077B6000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	HPXmmgLUSavYuccxma5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	HPXmmgLUSavYuccxma5.exe

Executes dropped EXE 64 IoCs

pid	Process
4056	HPXmmgLUSavYuccxma5.exe
1976	HPXmmgLUSavYuccxma5.exe
708	HPXmmgLUSavYuccxma5.exe
1308	HPXmmgLUSavYuccxma5.exe
1584	HPXmmgLUSavYuccxma5.exe
3776	HPXmmgLUSavYuccxma5.exe
544	HPXmmgLUSavYuccxma5.exe
2940	HPXmmgLUSavYuccxma5.exe
3764	HPXmmgLUSavYuccxma5.exe
2856	HPXmmgLUSavYuccxma5.exe
3400	HPXmmgLUSavYuccxma5.exe
1632	HPXmmgLUSavYuccxma5.exe
1060	HPXmmgLUSavYuccxma5.exe
2496	HPXmmgLUSavYuccxma5.exe
1076	HPXmmgLUSavYuccxma5.exe
4828	HPXmmgLUSavYuccxma5.exe
4528	HPXmmgLUSavYuccxma5.exe
776	HPXmmgLUSavYuccxma5.exe
3628	HPXmmgLUSavYuccxma5.exe
2212	HPXmmgLUSavYuccxma5.exe
4260	HPXmmgLUSavYuccxma5.exe
1144	HPXmmgLUSavYuccxma5.exe
1096	HPXmmgLUSavYuccxma5.exe
2580	HPXmmgLUSavYuccxma5.exe
776	HPXmmgLUSavYuccxma5.exe
4408	HPXmmgLUSavYuccxma5.exe
2900	HPXmmgLUSavYuccxma5.exe
456	HPXmmgLUSavYuccxma5.exe
1384	HPXmmgLUSavYuccxma5.exe
2096	HPXmmgLUSavYuccxma5.exe
2796	HPXmmgLUSavYuccxma5.exe
4080	HPXmmgLUSavYuccxma5.exe
4876	HPXmmgLUSavYuccxma5.exe
3040	HPXmmgLUSavYuccxma5.exe
2668	HPXmmgLUSavYuccxma5.exe
216	HPXmmgLUSavYuccxma5.exe
3824	HPXmmgLUSavYuccxma5.exe
4052	HPXmmgLUSavYuccxma5.exe
2496	HPXmmgLUSavYuccxma5.exe
4848	HPXmmgLUSavYuccxma5.exe
4260	HPXmmgLUSavYuccxma5.exe
1400	HPXmmgLUSavYuccxma5.exe
2532	HPXmmgLUSavYuccxma5.exe
1096	HPXmmgLUSavYuccxma5.exe
2092	HPXmmgLUSavYuccxma5.exe
1996	HPXmmgLUSavYuccxma5.exe
4408	HPXmmgLUSavYuccxma5.exe
4304	HPXmmgLUSavYuccxma5.exe
2140	HPXmmgLUSavYuccxma5.exe
2692	HPXmmgLUSavYuccxma5.exe
608	HPXmmgLUSavYuccxma5.exe
1676	HPXmmgLUSavYuccxma5.exe
4052	HPXmmgLUSavYuccxma5.exe
2496	HPXmmgLUSavYuccxma5.exe
3988	HPXmmgLUSavYuccxma5.exe
2212	HPXmmgLUSavYuccxma5.exe
756	HPXmmgLUSavYuccxma5.exe
2240	HPXmmgLUSavYuccxma5.exe
2532	HPXmmgLUSavYuccxma5.exe
440	HPXmmgLUSavYuccxma5.exe
4552	HPXmmgLUSavYuccxma5.exe
3460	HPXmmgLUSavYuccxma5.exe
4848	HPXmmgLUSavYuccxma5.exe
468	HPXmmgLUSavYuccxma5.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Roaming\\invoice"	HPXmmgLUSavYuccxma5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Roaming\\invoice"	HPXmmgLUSavYuccxma5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	bot.whatismyipaddress.com
31	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4056 set thread context of 1092	4056	HPXmmgLUSavYuccxma5.exe	114
PID 1976 set thread context of 4692	1976	HPXmmgLUSavYuccxma5.exe	122

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
2132	708	WerFault.exe	123
2680	1308	WerFault.exe	127
1632	1584	WerFault.exe	130
756	3776	WerFault.exe	133
2496	544	WerFault.exe	136
2880	2940	WerFault.exe	139
4828	3764	WerFault.exe	142
708	2856	WerFault.exe	145
1996	3400	WerFault.exe	148
3460	1632	WerFault.exe	151
3004	1060	WerFault.exe	154
1468	2496	WerFault.exe	157
1772	1076	WerFault.exe	160
1108	4828	WerFault.exe	163
3948	4528	WerFault.exe	166
1272	776	WerFault.exe	169
4264	3628	WerFault.exe	172
3348	2212	WerFault.exe	175
2880	4260	WerFault.exe	178
2668	1144	WerFault.exe	181
1308	1096	WerFault.exe	184
4740	2580	WerFault.exe	187
1060	776	WerFault.exe	191
3348	4408	WerFault.exe	194
1552	2900	WerFault.exe	197
4608	456	WerFault.exe	200
4744	1384	WerFault.exe	203
1464	2096	WerFault.exe	206
1668	2796	WerFault.exe	209
544	4080	WerFault.exe	212
3988	4876	WerFault.exe	215
4616	3040	WerFault.exe	218
1104	2668	WerFault.exe	221
2428	216	WerFault.exe	224
4404	3824	WerFault.exe	227
3504	4052	WerFault.exe	230
3628	2496	WerFault.exe	233
3136	4848	WerFault.exe	237
4304	4260	WerFault.exe	240
1084	1400	WerFault.exe	243
2404	2532	WerFault.exe	246
4512	1096	WerFault.exe	249
2688	2092	WerFault.exe	252
3424	1996	WerFault.exe	255
3040	4408	WerFault.exe	258
2212	4304	WerFault.exe	261
756	2140	WerFault.exe	264
3720	2692	WerFault.exe	267
3504	608	WerFault.exe	270
928	1676	WerFault.exe	273
1412	4052	WerFault.exe	276
708	2496	WerFault.exe	279
3776	3988	WerFault.exe	282
1736	2212	WerFault.exe	285
1464	756	WerFault.exe	288
1668	2240	WerFault.exe	291
4640	2532	WerFault.exe	294
2104	440	WerFault.exe	297
4584	4552	WerFault.exe	300
1656	3460	WerFault.exe	303
3696	4848	WerFault.exe	306
4608	468	WerFault.exe	309
2580	2576	WerFault.exe	312
4256	4016	WerFault.exe	315

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe
4056	HPXmmgLUSavYuccxma5.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1976	HPXmmgLUSavYuccxma5.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4056	HPXmmgLUSavYuccxma5.exe
1976	HPXmmgLUSavYuccxma5.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	HPXmmgLUSavYuccxma5.exe
Token: SeDebugPrivilege	1092	RegAsm.exe
Token: SeDebugPrivilege	1976	HPXmmgLUSavYuccxma5.exe
Token: SeDebugPrivilege	4692	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 4056	3012	8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe	90
PID 3012 wrote to memory of 4056	3012	8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe	90
PID 3012 wrote to memory of 4056	3012	8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe	90
PID 4056 wrote to memory of 2908	4056	HPXmmgLUSavYuccxma5.exe	93
PID 4056 wrote to memory of 2908	4056	HPXmmgLUSavYuccxma5.exe	93
PID 4056 wrote to memory of 2908	4056	HPXmmgLUSavYuccxma5.exe	93
PID 2908 wrote to memory of 2352	2908	csc.exe	95
PID 2908 wrote to memory of 2352	2908	csc.exe	95
PID 2908 wrote to memory of 2352	2908	csc.exe	95
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	96
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	96
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	96
PID 1976 wrote to memory of 3628	1976	csc.exe	99
PID 1976 wrote to memory of 3628	1976	csc.exe	99
PID 1976 wrote to memory of 3628	1976	csc.exe	99
PID 4056 wrote to memory of 1092	4056	HPXmmgLUSavYuccxma5.exe	114
PID 4056 wrote to memory of 1092	4056	HPXmmgLUSavYuccxma5.exe	114
PID 4056 wrote to memory of 1092	4056	HPXmmgLUSavYuccxma5.exe	114
PID 4056 wrote to memory of 1092	4056	HPXmmgLUSavYuccxma5.exe	114
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	115
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	115
PID 4056 wrote to memory of 1976	4056	HPXmmgLUSavYuccxma5.exe	115
PID 1976 wrote to memory of 4580	1976	HPXmmgLUSavYuccxma5.exe	116
PID 1976 wrote to memory of 4580	1976	HPXmmgLUSavYuccxma5.exe	116
PID 1976 wrote to memory of 4580	1976	HPXmmgLUSavYuccxma5.exe	116
PID 4580 wrote to memory of 1308	4580	csc.exe	118
PID 4580 wrote to memory of 1308	4580	csc.exe	118
PID 4580 wrote to memory of 1308	4580	csc.exe	118
PID 1976 wrote to memory of 448	1976	HPXmmgLUSavYuccxma5.exe	119
PID 1976 wrote to memory of 448	1976	HPXmmgLUSavYuccxma5.exe	119
PID 1976 wrote to memory of 448	1976	HPXmmgLUSavYuccxma5.exe	119
PID 448 wrote to memory of 5008	448	csc.exe	121
PID 448 wrote to memory of 5008	448	csc.exe	121
PID 448 wrote to memory of 5008	448	csc.exe	121
PID 1976 wrote to memory of 4692	1976	HPXmmgLUSavYuccxma5.exe	122
PID 1976 wrote to memory of 4692	1976	HPXmmgLUSavYuccxma5.exe	122
PID 1976 wrote to memory of 4692	1976	HPXmmgLUSavYuccxma5.exe	122
PID 1976 wrote to memory of 4692	1976	HPXmmgLUSavYuccxma5.exe	122
PID 1976 wrote to memory of 708	1976	HPXmmgLUSavYuccxma5.exe	123
PID 1976 wrote to memory of 708	1976	HPXmmgLUSavYuccxma5.exe	123
PID 1976 wrote to memory of 708	1976	HPXmmgLUSavYuccxma5.exe	123
PID 1976 wrote to memory of 1308	1976	HPXmmgLUSavYuccxma5.exe	127
PID 1976 wrote to memory of 1308	1976	HPXmmgLUSavYuccxma5.exe	127
PID 1976 wrote to memory of 1308	1976	HPXmmgLUSavYuccxma5.exe	127
PID 1976 wrote to memory of 1584	1976	HPXmmgLUSavYuccxma5.exe	130
PID 1976 wrote to memory of 1584	1976	HPXmmgLUSavYuccxma5.exe	130
PID 1976 wrote to memory of 1584	1976	HPXmmgLUSavYuccxma5.exe	130
PID 1976 wrote to memory of 3776	1976	HPXmmgLUSavYuccxma5.exe	133
PID 1976 wrote to memory of 3776	1976	HPXmmgLUSavYuccxma5.exe	133
PID 1976 wrote to memory of 3776	1976	HPXmmgLUSavYuccxma5.exe	133
PID 1976 wrote to memory of 544	1976	HPXmmgLUSavYuccxma5.exe	136
PID 1976 wrote to memory of 544	1976	HPXmmgLUSavYuccxma5.exe	136
PID 1976 wrote to memory of 544	1976	HPXmmgLUSavYuccxma5.exe	136
PID 1976 wrote to memory of 2940	1976	HPXmmgLUSavYuccxma5.exe	139
PID 1976 wrote to memory of 2940	1976	HPXmmgLUSavYuccxma5.exe	139
PID 1976 wrote to memory of 2940	1976	HPXmmgLUSavYuccxma5.exe	139
PID 1976 wrote to memory of 3764	1976	HPXmmgLUSavYuccxma5.exe	142
PID 1976 wrote to memory of 3764	1976	HPXmmgLUSavYuccxma5.exe	142
PID 1976 wrote to memory of 3764	1976	HPXmmgLUSavYuccxma5.exe	142
PID 1976 wrote to memory of 2856	1976	HPXmmgLUSavYuccxma5.exe	145
PID 1976 wrote to memory of 2856	1976	HPXmmgLUSavYuccxma5.exe	145
PID 1976 wrote to memory of 2856	1976	HPXmmgLUSavYuccxma5.exe	145
PID 1976 wrote to memory of 3400	1976	HPXmmgLUSavYuccxma5.exe	148
PID 1976 wrote to memory of 3400	1976	HPXmmgLUSavYuccxma5.exe	148

C:\Users\Admin\AppData\Local\Temp\8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8d897a409a231c4bdb21ac3bcf9118b1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\loqy0kwp\loqy0kwp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5BA.tmp" "c:\Users\Admin\AppData\Local\Temp\loqy0kwp\CSC92D5B258D41943F2A71A57D574A6B061.TMP"
      4⤵
      PID:2352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfpeelze\mfpeelze.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF721.tmp" "c:\Users\Admin\AppData\Local\Temp\mfpeelze\CSC400523B431464CD2A35D9B1B29701356.TMP"
      4⤵
      PID:3628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfwqnwig\vfwqnwig.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2248.tmp" "c:\Users\Admin\AppData\Local\Temp\vfwqnwig\CSC7783562687AD49B58735FECC848C4DD9.TMP"
        5⤵
        
        PID:1308
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rfkat3et\rfkat3et.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23EE.tmp" "c:\Users\Admin\AppData\Local\Temp\rfkat3et\CSC7B890270DEF644229127C91DB45F829.TMP"
        5⤵
        
        PID:5008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 964
        5⤵
        Program crash
        
        PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 940
        5⤵
        Program crash
        
        PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 940
        5⤵
        Program crash
        
        PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 940
        5⤵
        Program crash
        
        PID:756
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 940
        5⤵
        Program crash
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 944
        5⤵
        Program crash
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 940
        5⤵
        Program crash
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 944
        5⤵
        Program crash
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 940
        5⤵
        Program crash
        
        PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 948
        5⤵
        Program crash
        
        PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 940
        5⤵
        Program crash
        
        PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 948
        5⤵
        Program crash
        
        PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 944
        5⤵
        Program crash
        
        PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 948
        5⤵
        Program crash
        
        PID:1108
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 944
        5⤵
        Program crash
        
        PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 944
        5⤵
        Program crash
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 940
        5⤵
        Program crash
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 940
        5⤵
        Program crash
        
        PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 940
        5⤵
        Program crash
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 948
        5⤵
        Program crash
        
        PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 940
        5⤵
        Program crash
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 940
        5⤵
        Program crash
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 944
        5⤵
        Program crash
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 940
        5⤵
        Program crash
        
        PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 940
        5⤵
        Program crash
        
        PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 940
        5⤵
        Program crash
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 940
        5⤵
        Program crash
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 956
        5⤵
        Program crash
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 940
        5⤵
        Program crash
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 948
        5⤵
        Program crash
        
        PID:544
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 940
        5⤵
        Program crash
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 948
        5⤵
        Program crash
        
        PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 940
        5⤵
        Program crash
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 940
        5⤵
        Program crash
        
        PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 948
        5⤵
        Program crash
        
        PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 940
        5⤵
        Program crash
        
        PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 944
        5⤵
        Program crash
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 940
        5⤵
        Program crash
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 940
        5⤵
        Program crash
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 940
        5⤵
        Program crash
        
        PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 940
        5⤵
        Program crash
        
        PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 940
        5⤵
        Program crash
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 948
        5⤵
        Program crash
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 948
        5⤵
        Program crash
        
        PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 944
        5⤵
        Program crash
        
        PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 940
        5⤵
        Program crash
        
        PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 940
        5⤵
        Program crash
        
        PID:756
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 940
        5⤵
        Program crash
        
        PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 944
        5⤵
        Program crash
        
        PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:1676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 944
        5⤵
        Program crash
        
        PID:928
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 940
        5⤵
        Program crash
        
        PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 940
        5⤵
        Program crash
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 940
        5⤵
        Program crash
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 940
        5⤵
        Program crash
        
        PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 948
        5⤵
        Program crash
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 948
        5⤵
        Program crash
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 948
        5⤵
        Program crash
        
        PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 944
        5⤵
        Program crash
        
        PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 940
        5⤵
        Program crash
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:3460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 940
        5⤵
        Program crash
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 940
        5⤵
        Program crash
        
        PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      Executes dropped EXE
      PID:468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 944
        5⤵
        Program crash
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 948
        5⤵
        Program crash
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 940
        5⤵
        Program crash
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 944
        5⤵
        
        PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 940
        5⤵
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 948
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 948
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 948
        5⤵
        
        PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 944
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 940
        5⤵
        
        PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 940
        5⤵
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 940
        5⤵
        
        PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 940
        5⤵
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 948
        5⤵
        
        PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 940
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 940
        5⤵
        
        PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 948
        5⤵
        
        PID:800
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 940
        5⤵
        
        PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 948
        5⤵
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 944
        5⤵
        
        PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 940
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 940
        5⤵
        
        PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 952
        5⤵
        
        PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 940
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 948
        5⤵
        
        PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 940
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 940
        5⤵
        
        PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 940
        5⤵
        
        PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 944
        5⤵
        
        PID:2484
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 948
        5⤵
        
        PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 940
        5⤵
        
        PID:652
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 964
        5⤵
        
        PID:688
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 940
        5⤵
        
        PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 952
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 944
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 944
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 940
        5⤵
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 940
        5⤵
        
        PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 944
        5⤵
        
        PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 944
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 940
        5⤵
        
        PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2340
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 940
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 944
        5⤵
        
        PID:732
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 940
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 940
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 940
        5⤵
        
        PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 948
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 944
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 948
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4320
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 952
        5⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 940
        5⤵
        
        PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 940
        5⤵
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 940
        5⤵
        
        PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 940
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 948
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 948
        5⤵
        
        PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 940
        5⤵
        
        PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 948
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 940
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 948
        5⤵
        
        PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 940
        5⤵
        
        PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 940
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 948
        5⤵
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 940
        5⤵
        
        PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 940
        5⤵
        
        PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 940
        5⤵
        
        PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 940
        5⤵
        
        PID:1104
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 940
        5⤵
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 940
        5⤵
        
        PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 940
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 952
        5⤵
        
        PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 940
        5⤵
        
        PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4652
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 948
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 940
        5⤵
        
        PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 952
        5⤵
        
        PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 944
        5⤵
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 940
        5⤵
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 940
        5⤵
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3272
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 940
        5⤵
        
        PID:892
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 952
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 948
        5⤵
        
        PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 948
        5⤵
        
        PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 944
        5⤵
        
        PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4708
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 940
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 940
        5⤵
        
        PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 956
        5⤵
        
        PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3660 -s 940
        5⤵
        
        PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 940
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 940
        5⤵
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 944
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 944
        5⤵
        
        PID:608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 940
        5⤵
        
        PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 948
        5⤵
        
        PID:456
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 948
        5⤵
        
        PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 940
        5⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 940
        5⤵
        
        PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 940
        5⤵
        
        PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 944
        5⤵
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2444
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 940
        5⤵
        
        PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 940
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 940
        5⤵
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 940
        5⤵
        
        PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 952
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 940
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 940
        5⤵
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 940
        5⤵
        
        PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 944
        5⤵
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 944
        5⤵
        
        PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 944
        5⤵
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 944
        5⤵
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 948
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 940
        5⤵
        
        PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 940
        5⤵
        
        PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 944
        5⤵
        
        PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 940
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 940
        5⤵
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 948
        5⤵
        
        PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 940
        5⤵
        
        PID:652
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 948
        5⤵
        
        PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 940
        5⤵
        
        PID:3764
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 948
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 940
        5⤵
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 940
        5⤵
        
        PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 948
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 948
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 952
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:440
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 940
        5⤵
        
        PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 940
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 948
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 948
        5⤵
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 940
        5⤵
        
        PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 940
        5⤵
        
        PID:640
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 940
        5⤵
        
        PID:608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 948
        5⤵
        
        PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 944
        5⤵
        
        PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 940
        5⤵
        
        PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 944
        5⤵
        
        PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 940
        5⤵
        
        PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 940
        5⤵
        
        PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 948
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 940
        5⤵
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3292
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 940
        5⤵
        
        PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 952
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 940
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 940
        5⤵
        
        PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 944
        5⤵
        
        PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 940
        5⤵
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 940
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 940
        5⤵
        
        PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 940
        5⤵
        
        PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 944
        5⤵
        
        PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 948
        5⤵
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 940
        5⤵
        
        PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 948
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 944
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 944
        5⤵
        
        PID:2688
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 940
        5⤵
        
        PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 940
        5⤵
        
        PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 940
        5⤵
        
        PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 948
        5⤵
        
        PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 940
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 940
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 944
        5⤵
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 940
        5⤵
        
        PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 944
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 952
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 952
        5⤵
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:5044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 940
        5⤵
        
        PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 948
        5⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 944
        5⤵
        
        PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 944
        5⤵
        
        PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 940
        5⤵
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 948
        5⤵
        
        PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 940
        5⤵
        
        PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 944
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 944
        5⤵
        
        PID:800
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 948
        5⤵
        
        PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 208
        5⤵
        
        PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 940
        5⤵
        
        PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 948
        5⤵
        
        PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 940
        5⤵
        
        PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 940
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 940
        5⤵
        
        PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 948
        5⤵
        
        PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 940
        5⤵
        
        PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 940
        5⤵
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 948
        5⤵
        
        PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 948
        5⤵
        
        PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 960
        5⤵
        
        PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 948
        5⤵
        
        PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 944
        5⤵
        
        PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 940
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 948
        5⤵
        
        PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 948
        5⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 948
        5⤵
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4408
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 940
        5⤵
        
        PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 948
        5⤵
        
        PID:824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 940
        5⤵
        
        PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 952
        5⤵
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 960
        5⤵
        
        PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 940
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 964
        5⤵
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 940
        5⤵
        
        PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 940
        5⤵
        
        PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 940
        5⤵
        
        PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 940
        5⤵
        
        PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 952
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 940
        5⤵
        
        PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 940
        5⤵
        
        PID:440
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 940
        5⤵
        
        PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 940
        5⤵
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 948
        5⤵
        
        PID:416
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 948
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 952
        5⤵
        
        PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 948
        5⤵
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 948
        5⤵
        
        PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2688
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 940
        5⤵
        
        PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 940
        5⤵
        
        PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 940
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4584
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 940
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 956
        5⤵
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 940
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 940
        5⤵
        
        PID:216
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 948
        5⤵
        
        PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3064
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 940
        5⤵
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 948
        5⤵
        
        PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 948
        5⤵
        
        PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 940
        5⤵
        
        PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 180 -s 948
        5⤵
        
        PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 948
        5⤵
        
        PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 948
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 940
        5⤵
        
        PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 948
        5⤵
        
        PID:608
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 940
        5⤵
        
        PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 948
        5⤵
        
        PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1396
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 948
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 940
        5⤵
        
        PID:440
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 940
        5⤵
        
        PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3844
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 948
        5⤵
        
        PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 948
        5⤵
        
        PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 948
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 940
        5⤵
        
        PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 952
        5⤵
        
        PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 952
        5⤵
        
        PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2748
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 940
        5⤵
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4644
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 948
        5⤵
        
        PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 956
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1120
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 940
        5⤵
        
        PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 948
        5⤵
        
        PID:180
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2256
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 948
        5⤵
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 940
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 940
        5⤵
        
        PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 948
        5⤵
        
        PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 948
        5⤵
        
        PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 948
        5⤵
        
        PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 956
        5⤵
        
        PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 948
        5⤵
        
        PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 940
        5⤵
        
        PID:892
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4032
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 940
        5⤵
        
        PID:824
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4788
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 956
        5⤵
        
        PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 948
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 948
        5⤵
        
        PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 940
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 952
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4180
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 948
        5⤵
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 948
        5⤵
        
        PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:1784
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 956
        5⤵
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 940
        5⤵
        
        PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 940
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 956
        5⤵
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4624
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 940
        5⤵
        
        PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 940
        5⤵
        
        PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:2036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 948
        5⤵
        
        PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:3040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 940
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 948
        5⤵
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
      4⤵
      PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4088,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:8
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 708 -ip 708
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1308 -ip 1308
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1584 -ip 1584
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3776 -ip 3776
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 544 -ip 544
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2940 -ip 2940
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3764 -ip 3764
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2856 -ip 2856
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3400 -ip 3400
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1632 -ip 1632
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1060 -ip 1060
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2496 -ip 2496
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1076 -ip 1076
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4828 -ip 4828
1⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4528 -ip 4528
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 776 -ip 776
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3628 -ip 3628
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2212 -ip 2212
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4260 -ip 4260
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1144 -ip 1144
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1096 -ip 1096
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2580 -ip 2580
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 776 -ip 776
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4408 -ip 4408
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2900 -ip 2900
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 456 -ip 456
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1384 -ip 1384
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2096 -ip 2096
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2796 -ip 2796
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4080 -ip 4080
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4876 -ip 4876
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3040 -ip 3040
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2668 -ip 2668
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 216 -ip 216
1⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3824 -ip 3824
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4052 -ip 4052
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2496 -ip 2496
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4848 -ip 4848
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4260 -ip 4260
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1400 -ip 1400
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2532 -ip 2532
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1096 -ip 1096
1⤵
PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2092 -ip 2092
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1996 -ip 1996
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4408 -ip 4408
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4304 -ip 4304
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2140 -ip 2140
1⤵
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2692 -ip 2692
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 608 -ip 608
1⤵
PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1676 -ip 1676
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4052 -ip 4052
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2496 -ip 2496
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3988 -ip 3988
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2212 -ip 2212
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 756 -ip 756
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2240 -ip 2240
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2532 -ip 2532
1⤵
PID:608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 440 -ip 440
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4552 -ip 4552
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3460 -ip 3460
1⤵
PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4848 -ip 4848
1⤵
PID:3564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 468 -ip 468
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2576 -ip 2576
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4016 -ip 4016
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4312 -ip 4312
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4524 -ip 4524
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4052 -ip 4052
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3600 -ip 3600
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3696 -ip 3696
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4004 -ip 4004
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3428 -ip 3428
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 1400 -ip 1400
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2228 -ip 2228
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4020 -ip 4020
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 1104 -ip 1104
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3564 -ip 3564
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1324 -ip 1324
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3988 -ip 3988
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 2900 -ip 2900
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 1076 -ip 1076
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2484 -ip 2484
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 1784 -ip 1784
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 652 -ip 652
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3628 -ip 3628
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 2340 -ip 2340
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2140 -ip 2140
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4740 -ip 4740
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3920 -ip 3920
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3144 -ip 3144
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2984 -ip 2984
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4100 -ip 4100
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 1596 -ip 1596
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4468 -ip 4468
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4216 -ip 4216
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4032 -ip 4032
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3616 -ip 3616
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3108 -ip 3108
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1776 -ip 1776
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2676 -ip 2676
1⤵
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 1784 -ip 1784
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1780 -ip 1780
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4052 -ip 4052
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2340 -ip 2340
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4232 -ip 4232
1⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4740 -ip 4740
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 4732 -ip 4732
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4700 -ip 4700
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2308 -ip 2308
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 1412 -ip 1412
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 1108 -ip 1108
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4320 -ip 4320
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 3272 -ip 3272
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1384 -ip 1384
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1004 -ip 1004
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3428 -ip 3428
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4176 -ip 4176
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3400 -ip 3400
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4524 -ip 4524
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4404 -ip 4404
1⤵
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2648 -ip 2648
1⤵
PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3460 -ip 3460
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2580 -ip 2580
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1552 -ip 1552
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 800 -ip 800
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3144 -ip 3144
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4824 -ip 4824
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3028 -ip 3028
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2404 -ip 2404
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3600 -ip 3600
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4216 -ip 4216
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1668 -ip 1668
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4380 -ip 4380
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3428 -ip 3428
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4652 -ip 4652
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2308 -ip 2308
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2228 -ip 2228
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1560 -ip 1560
1⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2404 -ip 2404
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1772 -ip 1772
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3272 -ip 3272
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4904 -ip 4904
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 216 -ip 216
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 4876
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3288 -ip 3288
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4708 -ip 4708
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1612 -ip 1612
1⤵
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1104 -ip 1104
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3660 -ip 3660
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 836 -ip 836
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2256 -ip 2256
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4732 -ip 4732
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4728 -ip 4728
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1260 -ip 1260
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4824 -ip 4824
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3028 -ip 3028
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 688 -ip 688
1⤵
PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1324 -ip 1324
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1996 -ip 1996
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1376 -ip 1376
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2444 -ip 2444
1⤵
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1988 -ip 1988
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2984 -ip 2984
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3720 -ip 3720
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2940 -ip 2940
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4552 -ip 4552
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1596 -ip 1596
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1772 -ip 1772
1⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1576 -ip 1576
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4304 -ip 4304
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1004 -ip 1004
1⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4016 -ip 4016
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1988 -ip 1988
1⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2984 -ip 2984
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1660 -ip 1660
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2956 -ip 2956
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1744 -ip 1744
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4608 -ip 4608
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2404 -ip 2404
1⤵
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 468 -ip 468
1⤵
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2648 -ip 2648
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1668 -ip 1668
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2900 -ip 2900
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1400 -ip 1400
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4176 -ip 4176
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2308 -ip 2308
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1612 -ip 1612
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3736 -ip 3736
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 440 -ip 440
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4384 -ip 4384
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 836 -ip 836
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1144 -ip 1144
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4904 -ip 4904
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4004 -ip 4004
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4312 -ip 4312
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4816 -ip 4816
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4976 -ip 4976
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4648 -ip 4648
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1316 -ip 1316
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1728 -ip 1728
1⤵
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4008 -ip 4008
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1828 -ip 1828
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3232 -ip 3232
1⤵
PID:3040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3292 -ip 3292
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2240 -ip 2240
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4264 -ip 4264
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4020 -ip 4020
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1656 -ip 1656
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1204 -ip 1204
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1032 -ip 1032
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4232 -ip 4232
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1996 -ip 1996
1⤵
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4304 -ip 4304
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1004 -ip 1004
1⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4072 -ip 4072
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 216 -ip 216
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4504 -ip 4504
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3580 -ip 3580
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1776 -ip 1776
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1612 -ip 1612
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4688 -ip 4688
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2096 -ip 2096
1⤵
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4384 -ip 4384
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4052 -ip 4052
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1928 -ip 1928
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4064 -ip 4064
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3144 -ip 3144
1⤵
PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2880 -ip 2880
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1408 -ip 1408
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5044 -ip 5044
1⤵
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4800 -ip 4800
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4572 -ip 4572
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1108 -ip 1108
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1640 -ip 1640
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4936 -ip 4936
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4848 -ip 4848
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4004 -ip 4004
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2104 -ip 2104
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 756 -ip 756
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4728 -ip 4728
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3920 -ip 3920
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1612 -ip 1612
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4512 -ip 4512
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2976 -ip 2976
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2156 -ip 2156
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4408 -ip 4408
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1928 -ip 1928
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 608 -ip 608
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4640 -ip 4640
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4312 -ip 4312
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2308 -ip 2308
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4524 -ip 4524
1⤵
PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3244 -ip 3244
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1468 -ip 1468
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3600 -ip 3600
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4740 -ip 4740
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2156 -ip 2156
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4408 -ip 4408
1⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1928 -ip 1928
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4804 -ip 4804
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1968 -ip 1968
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2532 -ip 2532
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4524 -ip 4524
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 776 -ip 776
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3600 -ip 3600
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4936 -ip 4936
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2288 -ip 2288
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4504 -ip 4504
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1784 -ip 1784
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4728 -ip 4728
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1744 -ip 1744
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1096 -ip 1096
1⤵
PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4256 -ip 4256
1⤵
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2288 -ip 2288
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4140 -ip 4140
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1988 -ip 1988
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1968 -ip 1968
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4016 -ip 4016
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2688 -ip 2688
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 824 -ip 824
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1744 -ip 1744
1⤵
PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4584 -ip 4584
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4256 -ip 4256
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1200 -ip 1200
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3108 -ip 3108
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2056 -ip 2056
1⤵
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3064 -ip 3064
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1244 -ip 1244
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1656 -ip 1656
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4032 -ip 4032
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 180 -ip 180
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4936 -ip 4936
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1824 -ip 1824
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2308 -ip 2308
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1572 -ip 1572
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1260 -ip 1260
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4020 -ip 4020
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1396 -ip 1396
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3768 -ip 3768
1⤵
PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2376 -ip 2376
1⤵
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3844 -ip 3844
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4904 -ip 4904
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 636 -ip 636
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4976 -ip 4976
1⤵
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2792 -ip 2792
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2936 -ip 2936
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2748 -ip 2748
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4644 -ip 4644
1⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3028 -ip 3028
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1120 -ip 1120
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2504 -ip 2504
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2256 -ip 2256
1⤵
PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4520 -ip 4520
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4216 -ip 4216
1⤵
PID:708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2308 -ip 2308
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3108 -ip 3108
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1988 -ip 1988
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 756 -ip 756
1⤵
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1668 -ip 1668
1⤵
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1780 -ip 1780
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4032 -ip 4032
1⤵
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4788 -ip 4788
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3600 -ip 3600
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4848 -ip 4848
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1996 -ip 1996
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 800 -ip 800
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4180 -ip 4180
1⤵
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2260 -ip 2260
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1784 -ip 1784
1⤵
PID:1204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3504 -ip 3504
1⤵
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4608 -ip 4608
1⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2428 -ip 2428
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4624 -ip 4624
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3764 -ip 3764
1⤵
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2036 -ip 2036
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3040 -ip 3040
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 836 -ip 836
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4380 -ip 4380
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Filesize
1KB

MD5
03214d9e080af5cbe7dd1a2aeb9e1e8a

SHA1
84964a1c84b57fda453928c80e140ae2e6fefca7

SHA256
2800551d4460fdb827a2274a8e5f59019ff6a1a1bfd3b4a4d26bceb68d88ef11

SHA512
37deb50e7043058a26a48199ee6a8ded7d4e74128e0e0ea1f5266475f838b8b0bf7577bbbe8816f282d674ec070e28f485a7609cef05b59ab2655aeec6d69620

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxm

Filesize
2.3MB

MD5
4b6dd3fa0fc4f3acddd93b3d4cdcfe87

SHA1
b6c2b6267a7103a8ba11698c7a8b19164e2332ea

SHA256
215b52ab5b3b5ce35de5b6a656fd6a614b9b1afffe0837a3679d28415eab6de5

SHA512
5e06e1e3f9837b3dcc6bae4cfb92552765193d8d283e0c1d3bfc552bf3fd20edcc3d8ecf47a2363e178a5fd1936f6c2afaffa2814c3946c1a9d14bc32953fff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe

Filesize
28KB

MD5
af744c4398b9d3cfd8be3946d03d4702

SHA1
5ff999e469c822807a08a247e3ba8b767c0e24e3

SHA256
6f097cb9fca1fac4affbfbffcdb85c25b719a225ff83b8ed33c0cfb52b217638

SHA512
d66fa82c163ad16cbd146a95e6cfbef6b0051b5b5c52052080c8b3acaf45b8c340ff934959a71ed99d1e906405dd2bb9fb21d49a7fe69c8aadb0933ca176bcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2248.tmp

Filesize
1KB

MD5
583caaa4fdb8656df0144d181d9fa7af

SHA1
331fa99536eb45d6d8434b0fdb1bc9bf441bff72

SHA256
bb292c16d5158bde3939cb0fb21d123ef952265ec0781078b3f5aa1a873723f3

SHA512
48b1f9eebc81dd408b2b0a15166dcbe0095f4fddf784eafc6e6eaea2f80d6e40071cd4e4c18adb00a803d275e665b18d64bb117d3a38a423eb5dc0c6d81cada6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES23EE.tmp

Filesize
1KB

MD5
c2df3a86420f4ae96ba82db48680aa80

SHA1
cef2e607568e0704f3d37879c1079e88d5766585

SHA256
c7b5b6068d292206a5559b03ba7f581c2d4d9fc6552bedc43537e27f16d85cdd

SHA512
563dfe0521457a8c6166f71239399f7a8696a564a38dbd6cb2b18f3313bee0512822b9b06994bbdfc6a796694edf4a916ae8659caab4d275272fcf6c060d0ce7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF5BA.tmp

Filesize
1KB

MD5
3c99561293909e6f8fdfb039a5f3c73c

SHA1
1ec26ecbfa43ddee95daee0e71600588dedaeeae

SHA256
089e11a6457d7e136ae1b63a79d68e0fc67cbd02f36b74ec85584240ee4cacb2

SHA512
7bd9546cbaf9b6684d27e1ec2251ffb2b038845654042a03a78f2301e554741aad537d11f1e10bfa20a9f53a2775eb1119f669f43a1d640d2bdacde1f1b89904

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF721.tmp

Filesize
1KB

MD5
3366f9fd8604f368e112689e5fcd5944

SHA1
50d0dd3f8c8c4d3143622b6bb2d2b10a56f911af

SHA256
01e438a4e76bac8026b553521a93a9b16b5d2930b9b29ad0e681dcd64ca89db7

SHA512
09c9e6bb3e94319c1da26b8291d61b29b48309e11dd80ea199c32ce6a47e842b8637cc3034784d0ea7286db7e6d08abf4f71e726c16c69685be9d18fdddcf8b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\loqy0kwp\loqy0kwp.dll

Filesize
1.5MB

MD5
d2a37aa435e9fbe183d1ba9069d449a0

SHA1
086bb3ff960b63333756621713cc5a518d23e316

SHA256
ae493e71f31d683c699c562d608ea30537a341df80a09f7fb6b3ff8a095b632a

SHA512
bf873ff2e19e2997e5a368b5f22a7226626ca8907ebba87af6a49b713b4e2799db41494fcfe11cd99c7565110a9eeec72b49275290a9f14b1cd6b96bd9768c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\mfpeelze\mfpeelze.dll

Filesize
1.5MB

MD5
c272a6b1ab28a77575cb92875379c32b

SHA1
518d27d49476bc4a8c9047965a61a61c24bb70f1

SHA256
aba6236e6c4788296dba5cb5d7b63cbb79f723c284ae3723c0aad5a987d20e64

SHA512
5074706a0c8fe4d6844c7168d08ba4c20b408069e5c6ba52c8edd4ce9b8c731214a95b97dba29b36fa9651d393eb8af7d8088acb4a8c504e56ff118eb9acc876

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfkat3et\rfkat3et.dll

Filesize
1.5MB

MD5
4fe5f62116c03cd7184f940ec79b064f

SHA1
c2e371d08d768588fb207c0410bc5af487f2a85f

SHA256
c07bdca585b51713563d3ce1f25d4f4d337ed5e1c77300dbdd9d9df84e55b96f

SHA512
98671a05303ebb7f768616e1c4f6d1c1ed037d2a8976e68a66633817c1a0c2c55167c457106ea18978fb23f479ffa6208ce9ba5be6817b0f84df45f55a387a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\vfwqnwig\vfwqnwig.dll

Filesize
1.5MB

MD5
873b2e3a44556e0ebf7b8cf3c65cb1d1

SHA1
b4c17b8afb4bdf3ff42852674c417db92d668343

SHA256
00453a5357e7c9e7b8e863e52e5ddf9f6c12a54cc3181093c633463cb05813e3

SHA512
4e79819edaed6839e804bc6b46217dd62a4056ec92bad552de39304a42cb76107c21ac02aff106d63503c8ba019462f8856af54dbea47faa89cc83f209312396

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\loqy0kwp\CSC92D5B258D41943F2A71A57D574A6B061.TMP

Filesize
652B

MD5
8faafed488592181f80d358caae6b8d2

SHA1
a411db758edcd7b00df840a415dbb48702ad552f

SHA256
55909d9ffc332d4adfa6f742bf55423d310d3ebcee06f0d1c804d9af165fe4c8

SHA512
985b42ce264be24d443b8d9389df37e7ec5d1233c4086f4282c6538423da10b185083fa02b79ffc252aa3b19c5bfeda80fe1b35936eeb951ad55f26b536d8ca4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\loqy0kwp\loqy0kwp.0.cs

Filesize
2.3MB

MD5
c4553a6c03961a891e252d294b9ddc9a

SHA1
e992302c0c55d53fdee7649d2a0b37f6a5d1e895

SHA256
72a239e00851771a77b50e21dd388e79f62bdf4ac4f35425f047477b04d26812

SHA512
8d36dcf23a3bd97bcc89c54d56e4a998e5ef1a70361d9ebade3b098125966276afd5ad15ff2efe5e1f5a8412ce6a9fe27280c25a56ad12799be89b8e0f082d35

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\loqy0kwp\loqy0kwp.cmdline

Filesize
302B

MD5
fad7c3958ff4116fc6a4bf691345bf43

SHA1
61d7d605a8fad434996f78500ced6d19385c71c8

SHA256
9f7d9973dd877fbd7a6ed559aa1e7ac572057f490ada6e861a86ea3c82216922

SHA512
1dd4825b9dfec1ec37dd5d2a52838f0c6820ba98fe91ad978a8930dadb2514b6e27cd00796cb5ff8deb2df3658741e7983916133f3d3cfb5a52d6dc62013c3ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mfpeelze\CSC400523B431464CD2A35D9B1B29701356.TMP

Filesize
652B

MD5
33a515aa6c536d97268271189453e9cc

SHA1
be1a29b9435e4553ea6f575a6211185c16c63a4f

SHA256
2bb652fdc6fc9c3283c0484de5f83461fa89cf21028fec8abeee5df782794525

SHA512
c30220aa97d62d63059d48db44af0e0582939b7bf8c29e6225447c3ccf6d58e1e0b8ee8ce2f31f71564431ce655db5f0304db742e6eecc5660ed92797a42fd36

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mfpeelze\mfpeelze.cmdline

Filesize
302B

MD5
7c88a4476b0bd6b17de95ee7034b8427

SHA1
84a6951c7c839ae075b49ec043dd16ea13bd473b

SHA256
461c7c21e6675a1d44b0d1a5252beab05058df27f4bf5ff178414c6ebd76bfca

SHA512
928d81ed1770e020b79e86c768d3c08b7ebc2cef6d22bd8912106c974bb8e2a95f9e198b5c7c0591574129b324ab8d86f35e2e7de825c73e0ff09f8afa0ae568

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rfkat3et\CSC7B890270DEF644229127C91DB45F829.TMP

Filesize
652B

MD5
3f2b6d89d4c38e5a54aa1335c8b3d6c1

SHA1
a77136ca2c53b88820da749faae68d796b1c2231

SHA256
2e880b14e6178d90d4ac2819d025813a8e44969a8f31d711145233c279d07643

SHA512
ed7ecf6a64d79913a2a74342ae9e5a8f8f77d54e0ce04fa1c4679038a4b8185e1f1c3bcff5cb9f0392ce16d86bcfe1561ff87bb42af2612ef3d6777b89f434f0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rfkat3et\rfkat3et.cmdline

Filesize
302B

MD5
7f0ba96facc5b1694d7ef5b602a31f78

SHA1
276ad91331afe83a504e20a95ba5ced113fd3225

SHA256
974df6d1584431a02211cb1748efe69841835321778a0ec75682b4471633b66e

SHA512
0ffe58c73dc6a1a91687ec71b032c409a9d252d3d64dbe2000b1113524ac0ebd48ea6431662b26da04829c4f1dfa866878fe080f8069c64ef1b104cc71b3feb2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vfwqnwig\CSC7783562687AD49B58735FECC848C4DD9.TMP

Filesize
652B

MD5
12fe8bad9cf7b6e02d291ea75598b16d

SHA1
7b728ace83a44dc7a2d72ab9170c17aa7d741b0e

SHA256
ddf5898726b47a84a3abeac195ab8fe628fa9018f90bb71e7e3c750d9953654c

SHA512
5ee8f2acd5935705c7cbc66dc856c0906c0652b1115f0ee0095c7ca5647542051964a39a3835b36deb6a4c802a5a19d7bf5898e27a826e4d191f70ec305f0327

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vfwqnwig\vfwqnwig.cmdline

Filesize
302B

MD5
2059e52d66cd6de9845380d3634038fd

SHA1
0c86fa822bf67d65efd991b4fd189e85e4f72dbf

SHA256
919ec7c1124cc17f994247f4dbfddf98d9a1490d4f8ff444ef7de69e63233051

SHA512
d8a1b127a6fabd06f344bc6cbef4f3fea6e2062e41549577ca10fbddc58e32e54f79b1a2cf2313859e95a7b875468aa9db8c06bb5da172450021744a08cf1a35

Download Submit
memory/1092-42-0x0000000007740000-0x00000000077B6000-memory.dmp

Filesize
472KB

Download
memory/1092-43-0x0000000009E70000-0x000000000A414000-memory.dmp

Filesize
5.6MB

Download
memory/1092-44-0x0000000009A60000-0x0000000009AFC000-memory.dmp

Filesize
624KB

Download
memory/1092-76-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Filesize
584KB

Download
memory/1092-41-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1092-74-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/1976-72-0x0000000005250000-0x00000000053DE000-memory.dmp

Filesize
1.6MB

Download
memory/1976-58-0x00000000050B0000-0x000000000523E000-memory.dmp

Filesize
1.6MB

Download
memory/4056-37-0x0000000004EE0000-0x000000000506E000-memory.dmp

Filesize
1.6MB

Download
memory/4056-8-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/4056-13-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4056-23-0x0000000004D50000-0x0000000004EDE000-memory.dmp

Filesize
1.6MB

Download
memory/4056-39-0x0000000004C50000-0x0000000004CE8000-memory.dmp

Filesize
608KB

Download
memory/4056-78-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/4056-7-0x00000000742FE000-0x00000000742FF000-memory.dmp

Filesize
4KB

Download
memory/4056-81-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download