Analysis
-
max time kernel
463s -
max time network
424s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02/09/2024, 10:11
Errors
Reason
Machine shutdown
General
-
Target
Win32.SAW-by_DesConnet.exe
-
Size
30.5MB
-
MD5
09716fd4d7ab6e6577fc038e56bec7d2
-
SHA1
c612574d204fd804e3670d74a67cb86970e7385c
-
SHA256
0b4275e3f2d5d1189ed6e997fa4c74d35c479a9b220d5e58fab731d3df7627c1
-
SHA512
4692084fa894892bdcc266f316be71822b847fcc7524105849326c49882678fc774a12d88ae308d2d75a0acd1dddf2036b53ad90a653d615ebf8ec85dc2408da
-
SSDEEP
196608:gD0BqGdgpQxUmLmER3RTsl/mfsD/eP6hcfA1f1YHY1VUX62uVDghPW:gDeJdUQpTBiNe69qeUPhe
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 17 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Modifies file permissions 1 TTPs 4 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 34 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 64 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 10 IoCs
-
Drops file in Windows directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Kills process with taskkill 1 IoCs
-
Modifies Control Panel 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 30 IoCs
-
Modifies registry class 64 IoCs
-
Opens file in notepad (likely ransom note) 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 44 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Win32.SAW-by_DesConnet.exe"C:\Users\Admin\AppData\Local\Temp\Win32.SAW-by_DesConnet.exe"1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c md C:\SAW2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\note.txt2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\windows\DisLogonUI.exe"C:\windows\DisLogonUI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1170.tmp\1171.tmp\1172.bat C:\windows\DisLogonUI.exe"3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows\system32\LogonUI.exe4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Windows4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\takeown.exetakeown /F C:\Users4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\system32\LogonUI.exe /Grant:r Admin:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c taskkill /f /im explorer.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\windows\explorer.exe"C:\windows\explorer.exe"2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 4963⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 4683⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 4083⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 4803⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7384 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7712 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 4083⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8256 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8504 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8740 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7592 -s 4123⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8832 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9392 -s 4683⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9836 -s 4683⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9948 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9988 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9732 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11108 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11248 -s 4723⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\1.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10364 -s 4683⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8212 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11868 -s 4683⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12096 -s 4763⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12184 -s 4723⤵
- Program crash
-
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11332 -s 4883⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\4.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\5.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13216 -s 4763⤵
- Program crash
-
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\3.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\windows\notepad.exe"C:\windows\notepad.exe" c:\windows\debug\2.txt2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\windows\help\End.exe"C:\windows\help\End.exe"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x420 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2080 -ip 20801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5112 -ip 51121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5940 -ip 59401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4496 -ip 44961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2488 -ip 24881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4352 -ip 43521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2316 -ip 23161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4872 -ip 48721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3656 -ip 36561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4896 -ip 48961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3464 -ip 34641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 924 -ip 9241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1592 -ip 15921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1548 -ip 15481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5068 -ip 50681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2228 -ip 22281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1836 -ip 18361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3916 -ip 39161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1408 -ip 14081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5552 -ip 55521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4996 -ip 49961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5860 -ip 58601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6060 -ip 60601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3988 -ip 39881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1948 -ip 19481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1488 -ip 14881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3180 -ip 31801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 744 -ip 7441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3152 -ip 31521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4844 -ip 48441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4192 -ip 41921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5072 -ip 50721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 2980 -ip 29801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5684 -ip 56841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1020 -ip 10201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2336 -ip 23361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5220 -ip 52201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2888 -ip 28881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3020 -ip 30201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5500 -ip 55001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3896 -ip 38961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3200 -ip 32001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1572 -ip 15721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5324 -ip 53241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5772 -ip 57721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4904 -ip 49041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5236 -ip 52361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5356 -ip 53561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5476 -ip 54761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3604 -ip 36041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5952 -ip 59521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 6056 -ip 60561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2800 -ip 28001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4452 -ip 44521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4600 -ip 46001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2952 -ip 29521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4908 -ip 49081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5504 -ip 55041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 700 -ip 7001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2924 -ip 29241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3944 -ip 39441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5984 -ip 59841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5440 -ip 54401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 828 -ip 8281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5900 -ip 59001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4232 -ip 42321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5948 -ip 59481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2076 -ip 20761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4784 -ip 47841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1216 -ip 12161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4560 -ip 45601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4852 -ip 48521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5548 -ip 55481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 5028 -ip 50281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4984 -ip 49841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4188 -ip 41881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2864 -ip 28641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4300 -ip 43001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1480 -ip 14801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2332 -ip 23321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5516 -ip 55161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3732 -ip 37321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 436 -ip 4361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4344 -ip 43441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4580 -ip 45801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3632 -ip 36321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2612 -ip 26121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3636 -ip 36361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3820 -ip 38201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2964 -ip 29641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 760 -ip 7601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4056 -ip 40561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2620 -ip 26201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4216 -ip 42161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5400 -ip 54001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3572 -ip 35721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5836 -ip 58361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 5352 -ip 53521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1936 -ip 19361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3892 -ip 38921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5608 -ip 56081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3756 -ip 37561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6228 -ip 62281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4312 -ip 43121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6276 -ip 62761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6296 -ip 62961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6268 -ip 62681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 6308 -ip 63081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6448 -ip 64481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6324 -ip 63241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6420 -ip 64201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6372 -ip 63721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6352 -ip 63521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6428 -ip 64281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6388 -ip 63881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6520 -ip 65201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 6604 -ip 66041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6676 -ip 66761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6724 -ip 67241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 6744 -ip 67441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6792 -ip 67921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 6828 -ip 68281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6776 -ip 67761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6844 -ip 68441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6912 -ip 69121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6936 -ip 69361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6968 -ip 69681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6980 -ip 69801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7060 -ip 70601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7120 -ip 71201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2052 -ip 20521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 7052 -ip 70521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3780 -ip 37801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 316 -ip 3161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6172 -ip 61721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 6504 -ip 65041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6332 -ip 63321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6304 -ip 63041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6248 -ip 62481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 6692 -ip 66921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6840 -ip 68401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 6668 -ip 66681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6772 -ip 67721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6952 -ip 69521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7016 -ip 70161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 7032 -ip 70321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7108 -ip 71081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6648 -ip 66481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 3864 -ip 38641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7112 -ip 71121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 6656 -ip 66561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7008 -ip 70081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6856 -ip 68561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 6360 -ip 63601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6540 -ip 65401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3304 -ip 33041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7232 -ip 72321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 7212 -ip 72121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 7392 -ip 73921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7384 -ip 73841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7460 -ip 74601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 7372 -ip 73721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 7484 -ip 74841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 7356 -ip 73561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7632 -ip 76321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 7604 -ip 76041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7576 -ip 75761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 7736 -ip 77361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7692 -ip 76921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 7728 -ip 77281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7764 -ip 77641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7700 -ip 77001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7904 -ip 79041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 7924 -ip 79241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 7952 -ip 79521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 8088 -ip 80881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 8052 -ip 80521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8044 -ip 80441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 8076 -ip 80761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 8136 -ip 81361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 8144 -ip 81441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6640 -ip 66401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 5172 -ip 51721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 936 -ip 9361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7260 -ip 72601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7316 -ip 73161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 7288 -ip 72881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 7648 -ip 76481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7640 -ip 76401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 7452 -ip 74521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7116 -ip 71161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 7448 -ip 74481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3012 -ip 30121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 6920 -ip 69201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 2152 -ip 21521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 7756 -ip 77561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 7888 -ip 78881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 7712 -ip 77121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8068 -ip 80681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 7876 -ip 78761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7188 -ip 71881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6720 -ip 67201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 7320 -ip 73201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 7172 -ip 71721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 7968 -ip 79681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 7508 -ip 75081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7600 -ip 76001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 7780 -ip 77801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4060 -ip 40601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 8180 -ip 81801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 7476 -ip 74761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 8256 -ip 82561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7872 -ip 78721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 8280 -ip 82801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8316 -ip 83161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 8304 -ip 83041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 8504 -ip 85041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 8488 -ip 84881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 8544 -ip 85441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 8524 -ip 85241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 8496 -ip 84961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 8652 -ip 86521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8688 -ip 86881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 8604 -ip 86041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 8596 -ip 85961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 8628 -ip 86281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8700 -ip 87001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 8680 -ip 86801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 8580 -ip 85801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 8724 -ip 87241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 8740 -ip 87401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 8804 -ip 88041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 8844 -ip 88441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 8944 -ip 89441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8900 -ip 89001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 8916 -ip 89161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8980 -ip 89801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 8972 -ip 89721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 9136 -ip 91361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 9052 -ip 90521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 9120 -ip 91201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7984 -ip 79841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 8084 -ip 80841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7836 -ip 78361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6652 -ip 66521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 7200 -ip 72001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 5232 -ip 52321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2244 -ip 22441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 8464 -ip 84641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7752 -ip 77521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 6016 -ip 60161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8712 -ip 87121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 8456 -ip 84561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 7832 -ip 78321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 9116 -ip 91161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 8928 -ip 89281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7592 -ip 75921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 9176 -ip 91761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 9188 -ip 91881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 8252 -ip 82521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 8216 -ip 82161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 8340 -ip 83401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1976 -ip 19761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 8832 -ip 88321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 3028 -ip 30281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 9048 -ip 90481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 7932 -ip 79321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6084 -ip 60841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 8532 -ip 85321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 9220 -ip 92201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 8452 -ip 84521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 4292 -ip 42921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7624 -ip 76241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 9336 -ip 93361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 9288 -ip 92881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 9392 -ip 93921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 9424 -ip 94241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 9508 -ip 95081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 9432 -ip 94321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 9520 -ip 95201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 9444 -ip 94441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 9672 -ip 96721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 9568 -ip 95681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 9752 -ip 97521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 9768 -ip 97681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 9656 -ip 96561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 9836 -ip 98361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 9904 -ip 99041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 9920 -ip 99201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 9812 -ip 98121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 9956 -ip 99561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 9936 -ip 99361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 10080 -ip 100801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 10048 -ip 100481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 10176 -ip 101761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 10192 -ip 101921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 10140 -ip 101401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 9276 -ip 92761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 9532 -ip 95321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 7828 -ip 78281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 9420 -ip 94201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9484 -ip 94841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 9180 -ip 91801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 9872 -ip 98721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 9736 -ip 97361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 9776 -ip 97761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 9828 -ip 98281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 9988 -ip 99881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 10016 -ip 100161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 9948 -ip 99481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 8992 -ip 89921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 8424 -ip 84241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 9244 -ip 92441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 9388 -ip 93881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 9472 -ip 94721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9524 -ip 95241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 10092 -ip 100921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 9732 -ip 97321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 10216 -ip 102161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 10156 -ip 101561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10064 -ip 100641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 7976 -ip 79761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 9468 -ip 94681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 10252 -ip 102521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 10296 -ip 102961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 10268 -ip 102681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 10324 -ip 103241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 10436 -ip 104361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 10516 -ip 105161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 10480 -ip 104801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 10572 -ip 105721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 10588 -ip 105881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10580 -ip 105801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 10696 -ip 106961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 10732 -ip 107321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 10740 -ip 107401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 10688 -ip 106881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 10768 -ip 107681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 10888 -ip 108881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 10760 -ip 107601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 10956 -ip 109561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 11024 -ip 110241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 11032 -ip 110321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 11000 -ip 110001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 11092 -ip 110921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 11108 -ip 111081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 11128 -ip 111281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 11248 -ip 112481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 9248 -ip 92481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 10380 -ip 103801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 10264 -ip 102641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9788 -ip 97881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 10476 -ip 104761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 10364 -ip 103641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8212 -ip 82121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 9976 -ip 99761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 10792 -ip 107921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 10844 -ip 108441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 10720 -ip 107201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 11084 -ip 110841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 11148 -ip 111481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 11220 -ip 112201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 5156 -ip 51561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 10368 -ip 103681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 10428 -ip 104281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 11212 -ip 112121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 9892 -ip 98921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 10912 -ip 109121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 11012 -ip 110121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 11344 -ip 113441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 11464 -ip 114641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 11544 -ip 115441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 11688 -ip 116881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 11780 -ip 117801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 11768 -ip 117681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 11860 -ip 118601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 11868 -ip 118681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 12096 -ip 120961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 12108 -ip 121081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 12012 -ip 120121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 12220 -ip 122201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 12260 -ip 122601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 12232 -ip 122321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 12140 -ip 121401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 12152 -ip 121521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 12212 -ip 122121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 12184 -ip 121841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 11332 -ip 113321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10104 -ip 101041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 11488 -ip 114881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 11616 -ip 116161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 11840 -ip 118401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 10600 -ip 106001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 12296 -ip 122961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 11368 -ip 113681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 12196 -ip 121961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 12124 -ip 121241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 12460 -ip 124601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 12552 -ip 125521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 12696 -ip 126961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 12824 -ip 128241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 12916 -ip 129161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 12832 -ip 128321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 12880 -ip 128801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 12964 -ip 129641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 13080 -ip 130801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 13120 -ip 131201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 13216 -ip 132161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 11632 -ip 116321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 12568 -ip 125681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 12524 -ip 125241⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
3Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9B
MD5cb90606d56cca555f729e49eb5c289e1
SHA10007fcb7b91991d829fb0ba6b25778142f9f8ddd
SHA25647c1588425da59818f47c3cf8f80b32c1663553b0579ca496b125e3fa3332296
SHA5128b614470fce4df8c4d762758cfd04dc3725ad94daaea173acb4bb2a532471e3a25459f1a37cb663e1c303481f56b1ebe142f3f4fcf5b7d8a215ff93588cc5fc6
-
Filesize
471B
MD5c2e3b19a475aba9622a002387bd2aaa1
SHA1bf439c5f982ad810dfa9d78785b2a813df64b255
SHA256aa76eaece289cfa33f37ffa302aeaaf97192c794e1dc28c1eea226f863139872
SHA51283d445bf2b3782644954511cb56d135922c15aa1e0e9ea4aa4b53749234110283419a198190410f89b8e1d25cbfe7e02abd9c689ca84262edfe1f0ba3db3564d
-
Filesize
420B
MD5053be1e853d5dc5f214e9fd584225926
SHA1050ad3a8fb95744aee544dd2891988ceb7790779
SHA2560988cb8035a237dc7460827e9a88af818dddc4cdfbc677521a1a49cc0cf07a9b
SHA5129185f87640d431c811436063d643bb9380a7ccba0a7b660189f18b72711d96894d5c85a347d0aa7a17bd38569e15e380338974a0974c7c9e137c169bd0d51104
-
Filesize
2KB
MD58b33dba6d0c9e9078a0ff901081b4276
SHA15427d385511b254709416a2790d05d80a84ba308
SHA256694b29c2142d02ee8142df4f26761af10c1f0dca11707af0d008aea8ef190b4a
SHA512fa3eeb2306aabb73bc5edef1b3dc455c3cc920b05765386e6cc33c0640a520af577ff0adfab00076a1f6df56de0af3bddf645d330c9d86e92a19cde7c7c3d5ee
-
Filesize
36KB
MD51d3c4e80c24cd236fa76a27435926362
SHA17dbb5cdcac2ba68296501209c9fe98edcca2d35f
SHA256dbcdcb3b5da2fff40a182288466d41e376b9c578ffcae1c40e53e6b2b1162b2e
SHA512b871c72d59f3422ef443502bdd0c955be46f34f599efb063dd5d8701902c390f8397df4d4d04699a03cc3326f4761a4d463df7ee8f7a32559ae0b0e39af41acf
-
Filesize
36KB
MD5eab75a01498a0489b0c35e8b7d0036e5
SHA1fd80fe2630e0443d1a1cef2bdb21257f3a162f86
SHA256fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47
SHA5122ec6c4f34dcf00b6588b536f15e3fe4d98a0b663c8d2a2df06aa7cface88e072e2c2b1b9aaf4dc5a17b29023a85297f1a007ff60b5d6d0c65d1546bf0e12dd45
-
Filesize
75KB
MD53d8f7da0c55973b3e442353f068fcb70
SHA107daf00156098733123d67f843f02315f8dd70e1
SHA256b8388aee522cc3862ccefa49dc3271f024cc6106e45542cea87c41bbdc087a54
SHA512798a3bca4aeb7d91b6956f9afe3d49fbbdbcb5010a2c92414f78112442eac656c6c9b6cb4638f0ce71e8ac371b1cca558f928d448e8bc708cc157f58b2fac11c
-
Filesize
97B
MD5165c4eb495a1e55b6aa27652f79faaa1
SHA12a72fe3964fdace12d0527f52b806e545d9797b2
SHA256d694847a55f98886fbb45c6cd2b0fed95d9cd7448660cd023c909b3659d1f51c
SHA512e749ffaf79a8b65f26500c72b3bdacd79c564b89ea16198695892840873ede2b63fda3c6d32480cc5296d7662f91332f83674a5170475d606912af20e5f14367
-
Filesize
300B
MD5abcf424697d1e71aad47c5dc6d313e1d
SHA1167f103a33a818eaee6838db10840eee7e9df161
SHA25648fb047ed6553f49d483e5f8376e2151977e322d6cfb6f562a1e9e4fc1ce105d
SHA512e5f47b53e1d2694bedeb5b421c1111732e5c2ca75514be6609089dc8a6cd91a115396b93c5ce96f0106c39d605df2f8b3a15dbc6038ab61036e7dfe831a20355
-
Filesize
13KB
MD5f93ef1222b575637bccb61ea780746cb
SHA17548ae4b6cf6b37a611c4245477504f381e2f10c
SHA256787b26565108aaf22d0d2f76a13fe4a077b6e1c05372fb88f5b4d5bf5f22210b
SHA512f6e53a8a5e53bca47d6d73bede27f4e1cf8668b2a465aa91d0957d8a04cb23b4cfdd148ea74fd43625e77fea1f0a3a94ed403903521787215f92d4df53314467
-
Filesize
8KB
MD58ad03e052e7be1dfebb7194d6c83b266
SHA1516e60e8d5c2c2c75654763aa7161862d26ad6bb
SHA256a9d79027e3f24c7ffe0130e7528df9e124b7eea58483fa38fb62723f587fcfcf
SHA51268665571e08e30ba221029dcb149b91a6de9b18b39b114981d536fc82d23e3fc23e88e906971395729b433cedc46f4b3da332d10148bdfd46a1df6b396436e78
-
Filesize
157KB
MD5076a7bc93ee3cd1f2b765c11c23da251
SHA128014d69d40d454737388b60c62cec32cfaef4eb
SHA2569141894fd49410fc9241bd6ae7e3540d62ec2e0f96f211d5ac3dbe5ce3c5e3ac
SHA512853f5995033d2e467d6bbc2b26bf90a4a50ac7b750ea28360a0e62c90a95b360627ef032f978dc5b3625135fc746ed457aed5c4ecb6b5c0a91d6eb72e1943210
-
Filesize
169KB
MD591453353b0b226390fcf6e7c14736d41
SHA1e74028eb806c6e05ff7e05b931bc419ae04d809a
SHA256f03daa3f86bbe207304406363b0fc79c6d2eb201adb9d6a3f1677c192594eabe
SHA512e20b80448639d8e46d7570a36d4c45da63fbf5ac07bf6e5fe7cdf97816d168b54fc84348f9e3dbc99e7b260a9642258ee66225f0aae1ef11f92844c8874a1b0c
-
Filesize
82KB
MD5fb9cfabfca925449b3c58a87a33bfe15
SHA1a286b457f1ae3953cefc20e02966f8ea25f50647
SHA2560dc95dd55d958b6c0d064eafac88dd429b40f89436264d1ec4417014012a85a5
SHA512bf0db12d84bc9d83a686dfec6a31b185d50240ab8386f9ea0cafc9bc9e5fff94f4304a562783ffe184aa175ca03d736b2ccb2ba0b86f2d0e5b7c6c04eba87c26
-
Filesize
143KB
MD548d62c37747ae21a6c55a34ae254f159
SHA17f7680697c31b92ae1f546506d472396283dab7c
SHA256664cc62bfb6eea11b71110f77d595251ecf999b9dbe202bd983dfb6818314a1c
SHA512c517797023d167286a833d71f5d87b8fb4122dd2aa24076cdc4e77b283533dcdbcca9412674b30169e438c82f0af11b23ba77bdaf644fafba64456db4735a23b
-
Filesize
92KB
MD5bc63fbe2de68bc26a26e2dcab71220fe
SHA1148c4d1d5ef9740ba436eb5600571a01be924bde
SHA256ace262faaa147d483aaadb24b1e1d9bae9368f5bebc9691e0ad06e0777335ec0
SHA5123942bb67a509428de50bd6ee23f8fe3c0facb99b0623637f5217f38c2b1e5186a488667377243d66879438b014325c1b5b369158dbed43dfb8fb252c1703dc32
-
Filesize
435KB
MD595c6b99b652021c9dd349aaa3eaf6ee3
SHA1fac2bad4feb6af940e6bc76efc7c2a22f954ae60
SHA256e9dccda79c8bcaaf4908a08db324e2cf20ab5405650ac909a1a0afa827d9c1fa
SHA512444dc1f36dd0cfafc4bd8d980ba4cd9226b66ea905be1ced55d608bc2ec883521c8ae24478feb6e328ba63c7cd173ad00625c0862664d150b4360848d8b78ff0
-
Filesize
86KB
MD585c0987efae0bf61e3598452c4483f7e
SHA1d0b7a2ae69e83f5763c2ce0e73273465b102168a
SHA256368a1adce8063fb04aee2b7e5b32dd10e287fe229ded464a9140b3319594b74e
SHA51291e1a0d112979fa9f9924749746d3802769fe4f95e50e7238405a3b658620dc57742d7f41e765adf29e19cc7ee3b5832e9739f3ccbbb9c1a74449d7844abd28a
-
Filesize
89KB
MD522d91f63f7f1842a8ddf3d832265906a
SHA12c917c7f5c779a602a24d9500bf81aad8698be2d
SHA256ab6de3025cafe6a9d5e4de61e9113b954fdbff59c8938ccf3507c6b8b450b0d6
SHA51252493105e2aff333d93471e18dee149be86881b8680bdebb5837368a3e2edeed47a666983befbfb20bd43085143ea32755001a57bf9adacabf4da3edd1e74a28
-
Filesize
162KB
MD56d7de7212bb5b27f3daecdb10c96a515
SHA1e8b350e627fb482e61b3abd9a9696167ce51688e
SHA2561410000ad3ef5d370984945bf84e417ac43b0618c4aa3e767cb0cbd8e6c84d4e
SHA51235572d3dfe281646345c1fb35da103d422d3908a430da0a4fbb1cf6e6014a53c0315442f69eab4e8af83cf2a40de93c6eeaf29dd10f72415a2800fba5595165b
-
Filesize
320KB
MD5842120c87acbcdb591fe16493cdb4bcb
SHA13770e5515233679c14cbc2579868f79979bbfc66
SHA256ef427a540d4a9e905a9641fd8c5e0d836fa660f5ab4a1c8ccde122ee12a7f66b
SHA5120c51ea522ab185140d4c4e4e98122bf8dcb9e741ab67fb8866530586369168c121dba163e337367fa2870be2807bd338a944053afd9a9cacabd7bed27f710a57
-
Filesize
448KB
MD594d30ebe1a3d16dfbcb446cae1bd9749
SHA1c209ef9d3b76a7dbf5b0609736030cb551639a2c
SHA2562deb339cc8e9871f37ef97e7e33660feeb57d6dd9fed364bdd85f8049b1d3ea2
SHA51268c8cdc4e7329c1a39f3ae4d07ededf3b7020b693d2cd602dee88fe4d5ffc356b8441d6a4db89780f85617f416c6841303abc5376bb2a2656a60b8610ce53d21
-
Filesize
45KB
MD59331642986fab172bd242e5891580e27
SHA17cb5493fc05bd8537f9e22c9d697507af6496aa9
SHA256b1c29c7d6a5c173e25aec1e3661eea4a40c5c6b0de2de3195f11324c023c3fb8
SHA51271551b6e862f65daed6f187861e59a0e5fcedcf05c4ae7f0f6cc77acff87762156f43ba7e2c4ffc3f3cd5278b2e51dc3a67b3b01bd23dc19766ac8e5f5b9b17c
-
Filesize
149KB
MD5d756fc6c9178df89cad5fa279badcbad
SHA18769f673ad09910e909d16cfbc6bc6801bca47c0
SHA256e70ed50b70d5dbdc5fedddb4a05b3719a6a245a302371a42f09fbc7a5c4b34b6
SHA512fa005c63142fa28e98ec7958c90472f1ba8e0afa3eb87e6880084f0e1affddb51d332f518256a8f71122c5eb4136b1d40116640a44964d51d89fae9a7471e2f5
-
Filesize
12.0MB
MD5c852b0bb2ae137aeeffd859ade19810b
SHA182865956e9068de7d4f4abcd4ef0240c23559f93
SHA25605b9c7a8a1705ded7f78f58f1c800725231cb8b5747693dac78d1b66511f97e1
SHA5127467cb1314a29d8c00905c8d6c4b7e849595a05ddeec8b797f5068ad8e3a50dac7c0bde57db3bdd1e8bec69dd183cedf4bc75b3f4691f65f7b5eb0c11699dc2c
-
Filesize
112KB
MD527cc5b1b56d823e24b0c8d42384cd5b9
SHA11ebaab93422608534300c09933f43ca346bb15d9
SHA256676632423cd6426a43b4ec9daa70c571ea4b27935064334e615975421b608b8b
SHA51247fbc19a87ad5688f61c773f7561678421f48ff0e6f5e9c036658ccc0c8c776dea08f15b0757d43a2b368908be7c374e9ebb207eaafd5da7d58243473090985c
-
Filesize
63KB
MD5348870a3f835350834acf6fbeda08368
SHA1b1cd296b2b8daa8a33c7d92174653889fb7d91a6
SHA25636b14275417eca22c85286a4da17f814af2ad218333340f540a203257da8149e
SHA51208b99cfa7a3245300aaf52e28a442d67bb723b1b0fe67d6671a563a4b487399dd2c6ec425e84b8f027bafb3c9396801dd3e3939a5f3eb5ca51a138d85881421e
-
Filesize
67KB
MD5288f47b90054df798c3f97134c346f24
SHA1517389e24c81b58849f13682df9c42cd5ea72fa9
SHA2566b6d9c6b8cfa55048c2262d9d884c0731967cc379390e9ce68824907d9b5c359
SHA5124a3c366d9ac95dd7a0bc689b774ba329b40471757d0ab35b16e96d8d8586f0f37572c94502831a9891954ca42289daba608ef793fd5ef11448e67b86c97ef7e2
-
Filesize
130KB
MD5dc4a4d62aba8dc46c2393bc2013abb7d
SHA10fd8e1c385fe503b42b027f7fbf352ff97654347
SHA256029aed847b464bd978eb791e17dee4419d446e14c2647ed2529929f41c876980
SHA512774c346986c925f593a91788684883bef581cd2d083b1c3bf03ef8743aaa27bd37fb2d2c24915d78f2bcd86bc53fd40145b9f06c2f5d14103dc154037e2d6fd1
-
Filesize
67KB
MD50adac709efcd3edd6e71fc37450969d7
SHA1c706e30ff1c221fec540d71542dcd7f366cdc4f9
SHA256e5531923370fc609e854cb445e216e11fa2495bdff97d90bf96665f3e68e6c2c
SHA512a41b738e2bc3da355051366d26ec79dc822ecf8b726040abcaddd4a1a668979a07a331b51138054ecf3be0b85761bb4ed727ac9ddcd05f8d53af43247149091b
-
Filesize
60KB
MD595ecf8646d4d898506b421d15d2bbc0f
SHA155e8c78339dad31f72e6f29eef20272b1e242149
SHA256cdab7acebde065472d1f3d6307a50df1f5b83317752030efdb42b65b3e3337b3
SHA5122439704d7b1b10b47d61826e0faf169c1c0b22605f8821f66524b15a629215017da378ee472261da7e942f5b3c9c9aedf6a24abd02ea6a4be131543e50a2abc8
-
Filesize
533KB
MD586086ffd0e4b603b9148a6441f7d550d
SHA12b318f2702386fb246e3702ed78b6a2ca7671083
SHA256ff6d2fd930453f7a13af315c63d90f5cc82aebcd68399022a91c1c1874ef18f2
SHA51274560b37fc29743e5226db418758c63c882e193af10ba75a8e0e51bf4c6a80c08b61e42717523b4990097e29b8c88f150f1ca5057d25e71bdcffec6cdb7e9f3e
-
Filesize
126B
MD5580483e4920f0e56e69df69634ceb57c
SHA1e78fb9f3e83544678d98b1f885464023c7bd21c7
SHA256cc0cf044b143ac0e56fb04896bc169eaac3f52f0f4f5f218b410e3e1f85f623a
SHA5126a589f57dc5ccac84bcef5e34849054e1b676340b6566044aa47c4029e15fef2f6b2754289c8304bafcdca70d0ad88f26dfb14607c7ccb453de665b0f84f0fee
-
Filesize
255B
MD5d8f7fb5df2c37f9df6fc1e794f111035
SHA16486bb231faf607392dde05a8110579c6099fd3d
SHA25693e0ed7b8f82138c4b34c923736e883f0ce39cf030e71ba655656a198724d6ba
SHA51201fdfbfef63fe064b7d5d0c8f0182a383e74cc03ac17f1f4c14285fc25eba07fcab884adcf2cd4e829ba4f5b444dca0e369ad28e37d219ee880380b4b55d811e
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
30.6MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
30.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
30.6MB
-
Filesize
30.6MB
-
Filesize
4KB
-
Filesize
30.6MB
-
Filesize
30.6MB
-
Filesize
30.6MB
-
Filesize
64KB
-
Filesize
30.6MB
-
Filesize
30.6MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
