gh0strat | c9edea36f2fa7e91c2955d489c847a50c391733b3d1c4ad780930aa186d5077c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Size

188KB
MD5

3c24b8368d1c03395c4c4b02ebcd1530
SHA1

64abe6e4a9c9aa859964a4629cc4e6afdd21aec5
SHA256

c9edea36f2fa7e91c2955d489c847a50c391733b3d1c4ad780930aa186d5077c
SHA512

783b239dd059f3eaa28469a83f619d103eaf563b7557c5bf67b770030d0d0bb16c2ebfcc7343de9909dfc7383e567307f72b88ce896a61dc8ebd49edda623b43
SSDEEP

3072:H2KsgypSznWkKrXQ0VHTTlBzK7fa4qR5J6HAb7JUt2lGgHqjuoKfybDgIpenwT1L:WI/znWkKjTTlBzK7fa4qR5J6HQ+twdqk

Score

10^/10

gh0strat discovery rat

Malware Config

Signatures

Gh0st RAT payload 64 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b37-2.dat	family_gh0strat
behavioral2/memory/3608-4-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4100-7-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3096-10-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4744-13-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4952-16-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/228-19-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/700-22-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4852-25-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2016-28-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/404-31-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4632-34-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/456-37-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1920-40-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4080-43-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3976-46-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4340-49-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1624-52-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4944-55-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3416-58-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1596-61-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4568-64-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2760-67-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4336-70-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/700-73-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2204-76-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3116-79-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4892-82-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4632-85-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/456-88-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/472-91-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4912-94-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4040-97-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3676-98-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1380-99-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3112-100-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2148-101-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4008-102-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4960-103-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3052-104-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4972-105-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4952-106-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4020-107-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1420-108-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2504-109-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1840-110-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4320-111-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3472-112-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4372-113-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4184-114-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3760-115-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2500-116-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1720-117-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/772-118-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4164-119-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3448-120-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/4872-121-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3020-122-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/2120-123-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3404-124-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/3312-125-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1552-126-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1792-127-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat
behavioral2/memory/1504-128-0x0000000010000000-0x0000000010027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Deletes itself 1 IoCs

pid	Process
3608	svchost.exe

Loads dropped DLL 64 IoCs

pid	Process
3608	svchost.exe
4100	svchost.exe
3096	svchost.exe
4744	svchost.exe
4952	svchost.exe
228	svchost.exe
700	svchost.exe
4852	svchost.exe
2016	svchost.exe
404	svchost.exe
4632	svchost.exe
456	svchost.exe
1920	svchost.exe
4080	svchost.exe
3976	svchost.exe
4340	svchost.exe
1624	svchost.exe
4944	svchost.exe
3416	svchost.exe
1596	svchost.exe
4568	svchost.exe
2760	svchost.exe
4336	svchost.exe
700	svchost.exe
2204	svchost.exe
3116	svchost.exe
4892	svchost.exe
4632	svchost.exe
456	svchost.exe
472	svchost.exe
4912	svchost.exe
4040	svchost.exe
3676	svchost.exe
1380	svchost.exe
3112	svchost.exe
2148	svchost.exe
4008	svchost.exe
4960	svchost.exe
3052	svchost.exe
4972	svchost.exe
4952	svchost.exe
4020	svchost.exe
1420	svchost.exe
2504	svchost.exe
1840	svchost.exe
4320	svchost.exe
3472	svchost.exe
4372	svchost.exe
4184	svchost.exe
3760	svchost.exe
2500	svchost.exe
1720	svchost.exe
772	svchost.exe
4164	svchost.exe
3448	svchost.exe
4872	svchost.exe
3020	svchost.exe
2120	svchost.exe
3404	svchost.exe
3312	svchost.exe
1552	svchost.exe
1792	svchost.exe
1504	svchost.exe
3644	svchost.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gdlutuytgt	svchost.exe
File created	C:\Windows\SysWOW64\grgmgwygoa	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gdlutuytgt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gbpunpkkux	svchost.exe
File created	C:\Windows\SysWOW64\grwreggyck	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gwyvyfgsxh	svchost.exe
File created	C:\Windows\SysWOW64\grnwdpnspv	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gilokvvrpx	svchost.exe
File created	C:\Windows\SysWOW64\gkkiabhwbh	svchost.exe
File created	C:\Windows\SysWOW64\gipjsvsnpm	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gwpbwonlls	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ggajehyqqr	svchost.exe
File created	C:\Windows\SysWOW64\gvalqpaqfp	svchost.exe
File created	C:\Windows\SysWOW64\gsphhnqnbo	svchost.exe
File created	C:\Windows\SysWOW64\gtlwgdatur	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gnyxknhtlg	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ghpylgmlwu	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gtemjklhtu	svchost.exe
File created	C:\Windows\SysWOW64\gqahsyxpdt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gvqqoyhjsb	svchost.exe
File created	C:\Windows\SysWOW64\glgxaqqdtl	svchost.exe
File created	C:\Windows\SysWOW64\gqecbyuldh	svchost.exe
File created	C:\Windows\SysWOW64\gcjkpwuytb	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gnlsimxsru	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ghjegxrweg	svchost.exe
File created	C:\Windows\SysWOW64\glwngpdxao	svchost.exe
File created	C:\Windows\SysWOW64\gaxvcssudd	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\ghpylgmlwu	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File created	C:\Windows\SysWOW64\gvnqsqjqyb	svchost.exe
File created	C:\Windows\SysWOW64\guwbmrwvsx	svchost.exe
File created	C:\Windows\SysWOW64\gipjsvsnpm	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe.txt	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\rtqjq.byj	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3112	3608	WerFault.exe	81
4352	4100	WerFault.exe	85
2700	3096	WerFault.exe	90
444	4744	WerFault.exe	94
348	4952	WerFault.exe	98
2800	228	WerFault.exe	101
3952	700	WerFault.exe	104
1472	4852	WerFault.exe	107
2192	2016	WerFault.exe	110
3360	404	WerFault.exe	114
2948	4632	WerFault.exe	117
2632	456	WerFault.exe	120
2240	1920	WerFault.exe	123
1828	4080	WerFault.exe	128
2252	3976	WerFault.exe	131
1260	4340	WerFault.exe	134
2972	1624	WerFault.exe	137
3088	4944	WerFault.exe	140
3128	3416	WerFault.exe	143
1468	1596	WerFault.exe	146
3264	4568	WerFault.exe	149
3152	2760	WerFault.exe	152
4900	4336	WerFault.exe	155
2504	700	WerFault.exe	158
1128	2204	WerFault.exe	161
4608	3116	WerFault.exe	164
4552	4892	WerFault.exe	167
2432	4632	WerFault.exe	170
5056	456	WerFault.exe	173
2076	472	WerFault.exe	176
4324	4912	WerFault.exe	179
3004	4040	WerFault.exe	182
476	3676	WerFault.exe	185
4748	1380	WerFault.exe	188
636	3112	WerFault.exe	191
4872	2148	WerFault.exe	194
3492	4008	WerFault.exe	197
444	4960	WerFault.exe	200
3704	3052	WerFault.exe	203
3316	4972	WerFault.exe	206
5116	4952	WerFault.exe	209
3240	4020	WerFault.exe	212
1532	1420	WerFault.exe	215
908	2504	WerFault.exe	219
3956	1840	WerFault.exe	222
2024	4320	WerFault.exe	225
3476	3472	WerFault.exe	229
1912	4372	WerFault.exe	232
2492	4184	WerFault.exe	235
3524	3760	WerFault.exe	238
4912	2500	WerFault.exe	241
4040	1720	WerFault.exe	244
4520	772	WerFault.exe	247
984	4164	WerFault.exe	250
3080	3448	WerFault.exe	253
3416	4872	WerFault.exe	256
2928	3020	WerFault.exe	259
4168	2120	WerFault.exe	262
1984	3404	WerFault.exe	265
2760	3312	WerFault.exe	268
3800	1552	WerFault.exe	271
1700	1792	WerFault.exe	274
1440	1504	WerFault.exe	277
4196	3644	WerFault.exe	280

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	772	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Token: SeRestorePrivilege	772	JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeRestorePrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeSecurityPrivilege	3608	svchost.exe
Token: SeSecurityPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeSecurityPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeSecurityPrivilege	3608	svchost.exe
Token: SeBackupPrivilege	3608	svchost.exe
Token: SeRestorePrivilege	3608	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeRestorePrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeSecurityPrivilege	4100	svchost.exe
Token: SeBackupPrivilege	4100	svchost.exe
Token: SeRestorePrivilege	4100	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeRestorePrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeSecurityPrivilege	3096	svchost.exe
Token: SeSecurityPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeSecurityPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeSecurityPrivilege	3096	svchost.exe
Token: SeBackupPrivilege	3096	svchost.exe
Token: SeRestorePrivilege	3096	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeRestorePrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeSecurityPrivilege	4744	svchost.exe
Token: SeSecurityPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeSecurityPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeSecurityPrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4744	svchost.exe
Token: SeRestorePrivilege	4744	svchost.exe
Token: SeBackupPrivilege	4952	svchost.exe
Token: SeRestorePrivilege	4952	svchost.exe
Token: SeBackupPrivilege	4952	svchost.exe
Token: SeBackupPrivilege	4952	svchost.exe
Token: SeSecurityPrivilege	4952	svchost.exe
Token: SeSecurityPrivilege	4952	svchost.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c24b8368d1c03395c4c4b02ebcd1530.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 804
  2⤵
  - Program crash
  PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3608 -ip 3608
1⤵
PID:976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 788
  2⤵
  - Program crash
  PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4100 -ip 4100
1⤵
PID:2228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 784
  2⤵
  - Program crash
  PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3096 -ip 3096
1⤵
PID:4872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 640
  2⤵
  - Program crash
  PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4744 -ip 4744
1⤵
PID:2400

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 784
  2⤵
  - Program crash
  PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4952 -ip 4952
1⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 704
  2⤵
  - Program crash
  PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 228 -ip 228
1⤵
PID:4544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 784
  2⤵
  - Program crash
  PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 700 -ip 700
1⤵
PID:2164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 772
  2⤵
  - Program crash
  PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4852 -ip 4852
1⤵
PID:944

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 772
  2⤵
  - Program crash
  PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2016 -ip 2016
1⤵
PID:3592

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 772
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 404 -ip 404
1⤵
PID:3960

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 784
  2⤵
  - Program crash
  PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4632 -ip 4632
1⤵
PID:3472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 764
  2⤵
  - Program crash
  PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 456 -ip 456
1⤵
PID:2300

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 780
  2⤵
  - Program crash
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1920 -ip 1920
1⤵
PID:5112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 784
  2⤵
  - Program crash
  PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4080 -ip 4080
1⤵
PID:4708

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 780
  2⤵
  - Program crash
  PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3976 -ip 3976
1⤵
PID:1332

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 788
  2⤵
  - Program crash
  PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4340 -ip 4340
1⤵
PID:1280

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 768
  2⤵
  - Program crash
  PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1624 -ip 1624
1⤵
PID:772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 784
  2⤵
  - Program crash
  PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4944 -ip 4944
1⤵
PID:4748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 700
  2⤵
  - Program crash
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3416 -ip 3416
1⤵
PID:4772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 784
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1596 -ip 1596
1⤵
PID:1628

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 752
  2⤵
  - Program crash
  PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4568 -ip 4568
1⤵
PID:2988

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:2760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 664
  2⤵
  - Program crash
  PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2760 -ip 2760
1⤵
PID:1016

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 784
  2⤵
  - Program crash
  PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4336 -ip 4336
1⤵
PID:4448

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 788
  2⤵
  - Program crash
  PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 700 -ip 700
1⤵
PID:4412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 784
  2⤵
  - Program crash
  PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2204 -ip 2204
1⤵
PID:3592

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 772
  2⤵
  - Program crash
  PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3116 -ip 3116
1⤵
PID:3548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 784
  2⤵
  - Program crash
  PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4892 -ip 4892
1⤵
PID:1540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 788
  2⤵
  - Program crash
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4632 -ip 4632
1⤵
PID:2892

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 784
  2⤵
  - Program crash
  PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 456 -ip 456
1⤵
PID:3872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 472 -s 784
  2⤵
  - Program crash
  PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 472 -ip 472
1⤵
PID:1812

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 772
  2⤵
  - Program crash
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4912 -ip 4912
1⤵
PID:2500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 784
  2⤵
  - Program crash
  PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4040 -ip 4040
1⤵
PID:1728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 784
  2⤵
  - Program crash
  PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3676 -ip 3676
1⤵
PID:3616

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 784
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1380 -ip 1380
1⤵
PID:3712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 772
  2⤵
  - Program crash
  PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3112 -ip 3112
1⤵
PID:2228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:2148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 784
  2⤵
  - Program crash
  PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2148 -ip 2148
1⤵
PID:2652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 784
  2⤵
  - Program crash
  PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4008 -ip 4008
1⤵
PID:564

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 772
  2⤵
  - Program crash
  PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4960 -ip 4960
1⤵
PID:764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 784
  2⤵
  - Program crash
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3052 -ip 3052
1⤵
PID:4168

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 676
  2⤵
  - Program crash
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4972 -ip 4972
1⤵
PID:4568

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 784
  2⤵
  - Program crash
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4952 -ip 4952
1⤵
PID:4428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 700
  2⤵
  - Program crash
  PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4020 -ip 4020
1⤵
PID:5104

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 784
  2⤵
  - Program crash
  PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1420 -ip 1420
1⤵
PID:3076

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 784
  2⤵
  - Program crash
  PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2504 -ip 2504
1⤵
PID:3488

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 784
  2⤵
  - Program crash
  PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1840 -ip 1840
1⤵
PID:2204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 768
  2⤵
  - Program crash
  PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4320 -ip 4320
1⤵
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 772
  2⤵
  - Program crash
  PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3472 -ip 3472
1⤵
PID:820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 784
  2⤵
  - Program crash
  PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4372 -ip 4372
1⤵
PID:4596

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 780
  2⤵
  - Program crash
  PID:2492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4184 -ip 4184
1⤵
PID:1740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 784
  2⤵
  - Program crash
  PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3760 -ip 3760
1⤵
PID:4728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 780
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2500 -ip 2500
1⤵
PID:4764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 772
  2⤵
  - Program crash
  PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1720 -ip 1720
1⤵
PID:3004

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 784
  2⤵
  - Program crash
  PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 772 -ip 772
1⤵
PID:476

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:4164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 784
  2⤵
  - Program crash
  PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4164 -ip 4164
1⤵
PID:4748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 784
  2⤵
  - Program crash
  PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3448 -ip 3448
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 784
  2⤵
  - Program crash
  PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4872 -ip 4872
1⤵
PID:2208

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 660
  2⤵
  - Program crash
  PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3020 -ip 3020
1⤵
PID:3768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 784
  2⤵
  - Program crash
  PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2120 -ip 2120
1⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 784
  2⤵
  - Program crash
  PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3404 -ip 3404
1⤵
PID:3052

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 788
  2⤵
  - Program crash
  PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3312 -ip 3312
1⤵
PID:712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 772
  2⤵
  - Program crash
  PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1552 -ip 1552
1⤵
PID:4952

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 784
  2⤵
  - Program crash
  PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1792 -ip 1792
1⤵
PID:1460

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
PID:1504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 784
  2⤵
  - Program crash
  PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1504 -ip 1504
1⤵
PID:4844

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:3644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 792
  2⤵
  - Program crash
  PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3644 -ip 3644
1⤵
PID:948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 784
  2⤵
  PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2848 -ip 2848
1⤵
PID:3956

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 784
  2⤵
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1840 -ip 1840
1⤵
PID:1924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 784
  2⤵
  PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1228 -ip 1228
1⤵
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 768
  2⤵
  PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 420 -ip 420
1⤵
PID:4620

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 736
  2⤵
  PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2508 -ip 2508
1⤵
PID:3816

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 772
  2⤵
  PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 688 -ip 688
1⤵
PID:5020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 784
  2⤵
  PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4472 -ip 4472
1⤵
PID:2240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 748
  2⤵
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5040 -ip 5040
1⤵
PID:4072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 700
  2⤵
  PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2500 -ip 2500
1⤵
PID:3044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 784
  2⤵
  PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4040 -ip 4040
1⤵
PID:1196

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 784
  2⤵
  PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4520 -ip 4520
1⤵
PID:2236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 784
  2⤵
  PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3428 -ip 3428
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1164 -s 784
  2⤵
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1164 -ip 1164
1⤵
PID:4980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 784
  2⤵
  PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2124 -ip 2124
1⤵
PID:2548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 784
  2⤵
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 960 -ip 960
1⤵
PID:4304

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 768
  2⤵
  PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3732 -ip 3732
1⤵
PID:5092

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 776
  2⤵
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 220 -ip 220
1⤵
PID:3996

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 784
  2⤵
  PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4972 -ip 4972
1⤵
PID:2452

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:5044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 768
  2⤵
  PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5044 -ip 5044
1⤵
PID:4020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 784
  2⤵
  PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2708 -ip 2708
1⤵
PID:5080

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 780
  2⤵
  PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3916 -ip 3916
1⤵
PID:3680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 784
  2⤵
  PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4696 -ip 4696
1⤵
PID:3548

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 796
  2⤵
  PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2204 -ip 2204
1⤵
PID:1064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:4180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 700
  2⤵
  PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4180 -ip 4180
1⤵
PID:1840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 784
  2⤵
  PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1540 -ip 1540
1⤵
PID:1228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 784
  2⤵
  PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3900 -ip 3900
1⤵
PID:420

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4784
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 784
  2⤵
  PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4784 -ip 4784
1⤵
PID:2508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 784
  2⤵
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1812 -ip 1812
1⤵
PID:2372

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:5008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 784
  2⤵
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5008 -ip 5008
1⤵
PID:2492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 784
  2⤵
  PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3460 -ip 3460
1⤵
PID:5040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 772
  2⤵
  PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2972 -ip 2972
1⤵
PID:2544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 772
  2⤵
  PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1268 -ip 1268
1⤵
PID:4748

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 784
  2⤵
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 772 -ip 772
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 784
  2⤵
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 636 -ip 636
1⤵
PID:4980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 784
  2⤵
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 316 -ip 316
1⤵
PID:764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 772
  2⤵
  PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 892 -ip 892
1⤵
PID:4744

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 784
  2⤵
  PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2400 -ip 2400
1⤵
PID:4544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 776
  2⤵
  PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1868 -ip 1868
1⤵
PID:3152

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 768
  2⤵
  PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 5076 -ip 5076
1⤵
PID:3672

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 772
  2⤵
  PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3312 -ip 3312
1⤵
PID:1452

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 768
  2⤵
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4628 -ip 4628
1⤵
PID:5044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 784
  2⤵
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4852 -ip 4852
1⤵
PID:2708

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 784
  2⤵
  PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3688 -ip 3688
1⤵
PID:1472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 784
  2⤵
  PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2644 -ip 2644
1⤵
PID:3592

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 784
  2⤵
  PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2504 -ip 2504
1⤵
PID:2204

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 700
  2⤵
  PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2948 -ip 2948
1⤵
PID:4180

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 796
  2⤵
  PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4692 -ip 4692
1⤵
PID:1540

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 784
  2⤵
  PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2640 -ip 2640
1⤵
PID:3900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:5112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 784
  2⤵
  PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5112 -ip 5112
1⤵
PID:4784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 712
  2⤵
  PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4424 -ip 4424
1⤵
PID:3364

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 792
  2⤵
  PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 3928 -ip 3928
1⤵
PID:4084

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 784
  2⤵
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3992 -ip 3992
1⤵
PID:2824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 784
  2⤵
  PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2544 -ip 2544
1⤵
PID:1904

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 772
  2⤵
  PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3120 -ip 3120
1⤵
PID:4040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 784
  2⤵
  PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1380 -ip 1380
1⤵
PID:1112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 784
  2⤵
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3416 -ip 3416
1⤵
PID:4808

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 788
  2⤵
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2928 -ip 2928
1⤵
PID:1164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 784
  2⤵
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4304 -ip 4304
1⤵
PID:4848

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 784
  2⤵
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2700 -ip 2700
1⤵
PID:2160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 796
  2⤵
  PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2400 -ip 2400
1⤵
PID:4272

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 784
  2⤵
  PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2744 -ip 2744
1⤵
PID:4900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:5076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 784
  2⤵
  PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5076 -ip 5076
1⤵
PID:4020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 696
  2⤵
  PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1780 -ip 1780
1⤵
PID:1440

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 784
  2⤵
  PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3952 -ip 3952
1⤵
PID:524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 768
  2⤵
  PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2164 -ip 2164
1⤵
PID:1472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 784
  2⤵
  PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2628 -ip 2628
1⤵
PID:4684

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 784
  2⤵
  PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2192 -ip 2192
1⤵
PID:1840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 784
  2⤵
  PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3612 -ip 3612
1⤵
PID:3872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 784
  2⤵
  PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1344 -ip 1344
1⤵
PID:456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 672
  2⤵
  PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1560 -ip 1560
1⤵
PID:2576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 784
  2⤵
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 820 -ip 820
1⤵
PID:1120

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 788
  2⤵
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3524 -ip 3524
1⤵
PID:1484

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 788
  2⤵
  PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2076 -ip 2076
1⤵
PID:3636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 784
  2⤵
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5040 -ip 5040
1⤵
PID:4788

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 788
  2⤵
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1280 -ip 1280
1⤵
PID:2824

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 700
  2⤵
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3972 -ip 3972
1⤵
PID:1728

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 752
  2⤵
  PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4040 -ip 4040
1⤵
PID:476

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 784
  2⤵
  PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1112 -ip 1112
1⤵
PID:3088

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 784
  2⤵
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4832 -ip 4832
1⤵
PID:2652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 784
  2⤵
  PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3596 -ip 3596
1⤵
PID:3508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 784
  2⤵
  PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4992 -ip 4992
1⤵
PID:2124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 656
  2⤵
  PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4540 -ip 4540
1⤵
PID:3020

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 784
  2⤵
  PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 960 -ip 960
1⤵
PID:4352

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 784
  2⤵
  PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3996 -ip 3996
1⤵
PID:1016

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 756
  2⤵
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1860 -ip 1860
1⤵
PID:396

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 772
  2⤵
  PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 116 -ip 116
1⤵
PID:2248

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 784
  2⤵
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2008 -ip 2008
1⤵
PID:2552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 772
  2⤵
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2820 -ip 2820
1⤵
PID:1524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 788
  2⤵
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3240 -ip 3240
1⤵
PID:1924

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 784
  2⤵
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4412 -ip 4412
1⤵
PID:1840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 772
  2⤵
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2644 -ip 2644
1⤵
PID:1668

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 784
  2⤵
  PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4124 -ip 4124
1⤵
PID:456

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 788
  2⤵
  PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2336 -ip 2336
1⤵
PID:5072

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 780
  2⤵
  PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1912 -ip 1912
1⤵
PID:2956

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 784
  2⤵
  PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 1120 -ip 1120
1⤵
PID:820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 784
  2⤵
  PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1484 -ip 1484
1⤵
PID:2840

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 768
  2⤵
  PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 4332
1⤵
PID:2252

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 784
  2⤵
  PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1744 -ip 1744
1⤵
PID:3224

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 784
  2⤵
  PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1272 -ip 1272
1⤵
PID:976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 784
  2⤵
  PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3852 -ip 3852
1⤵
PID:928

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 716
  2⤵
  PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1624 -ip 1624
1⤵
PID:3712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 768
  2⤵
  PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 868 -ip 868
1⤵
PID:4884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 772
  2⤵
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1592 -ip 1592
1⤵
PID:2364

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 784
  2⤵
  PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1444 -ip 1444
1⤵
PID:2596

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 784
  2⤵
  PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3036 -ip 3036
1⤵
PID:4280

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 784
  2⤵
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4304 -ip 4304
1⤵
PID:1696

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 796
  2⤵
  PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1776 -ip 1776
1⤵
PID:2784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 784
  2⤵
  PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 960 -ip 960
1⤵
PID:228

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 784
  2⤵
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 348 -ip 348
1⤵
PID:4972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 772
  2⤵
  PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1980 -ip 1980
1⤵
PID:1552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 784
  2⤵
  PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1452 -ip 1452
1⤵
PID:948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 784
  2⤵
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1176 -ip 1176
1⤵
PID:908

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 784
  2⤵
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4240 -ip 4240
1⤵
PID:2164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 784
  2⤵
  PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4116 -ip 4116
1⤵
PID:2100

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 788
  2⤵
  PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4320 -ip 4320
1⤵
PID:3588

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 784
  2⤵
  PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2692 -ip 2692
1⤵
PID:3644

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:5028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 780
  2⤵
  PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5028 -ip 5028
1⤵
PID:2740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 788
  2⤵
  PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2016 -ip 2016
1⤵
PID:4708

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 784
  2⤵
  PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3100 -ip 3100
1⤵
PID:820

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 784
  2⤵
  PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4380 -ip 4380
1⤵
PID:3636

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 772
  2⤵
  PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2392 -ip 2392
1⤵
PID:688

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 772
  2⤵
  PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3892 -ip 3892
1⤵
PID:2528

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 772
  2⤵
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3536 -ip 3536
1⤵
PID:4080

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 784
  2⤵
  PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2824 -ip 2824
1⤵
PID:2500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 784
  2⤵
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4948 -ip 4948
1⤵
PID:3064

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 784
  2⤵
  PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3120 -ip 3120
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 784
  2⤵
  PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4884 -ip 4884
1⤵
PID:4716

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 784
  2⤵
  PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4776 -ip 4776
1⤵
PID:2364

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 784
  2⤵
  PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5084 -ip 5084
1⤵
PID:4532

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 784
  2⤵
  PID:564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2484 -ip 2484
1⤵
PID:4264

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 784
  2⤵
  PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4892 -ip 4892
1⤵
PID:444

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 784
  2⤵
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2384 -ip 2384
1⤵
PID:4352

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 784
  2⤵
  PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 228 -ip 228
1⤵
PID:3732

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 784
  2⤵
  PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2212 -ip 2212
1⤵
PID:2960

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 788
  2⤵
  PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1328 -ip 1328
1⤵
PID:2908

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 784
  2⤵
  PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4432 -ip 4432
1⤵
PID:3568

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 784
  2⤵
  PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2624 -ip 2624
1⤵
PID:1008

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:5088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 784
  2⤵
  PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5088 -ip 5088
1⤵
PID:3680

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 784
  2⤵
  PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2100 -ip 2100
1⤵
PID:2724

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 784
  2⤵
  PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3936 -ip 3936
1⤵
PID:2308

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 784
  2⤵
  PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2192 -ip 2192
1⤵
PID:4888

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 788
  2⤵
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2740 -ip 2740
1⤵
PID:5028

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 784
  2⤵
  PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2956 -ip 2956
1⤵
PID:4472

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 772
  2⤵
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1344 -ip 1344
1⤵
PID:3100

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 784
  2⤵
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3472 -ip 3472
1⤵
PID:2852

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 784
  2⤵
  PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1484 -ip 1484
1⤵
PID:2528

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:3976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 784
  2⤵
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3976 -ip 3976
1⤵
PID:4080

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 768
  2⤵
  PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1332 -ip 1332
1⤵
PID:3972

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 784
  2⤵
  PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3004 -ip 3004
1⤵
PID:1500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 788
  2⤵
  PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3392 -ip 3392
1⤵
PID:3656

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 768
  2⤵
  PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 476 -ip 476
1⤵
PID:984

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 784
  2⤵
  PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3088 -ip 3088
1⤵
PID:3220

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 784
  2⤵
  PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3584 -ip 3584
1⤵
PID:3492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 700
  2⤵
  PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 876 -ip 876
1⤵
PID:3768

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:564
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 784
  2⤵
  PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 564 -ip 564
1⤵
PID:4968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 784
  2⤵
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2160 -ip 2160
1⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 772
  2⤵
  PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 220 -ip 220
1⤵
PID:4900

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:228
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 784
  2⤵
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 228 -ip 228
1⤵
PID:1552

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 784
  2⤵
  PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2212 -ip 2212
1⤵
PID:2136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 788
  2⤵
  PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2908 -ip 2908
1⤵
PID:116

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 768
  2⤵
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1792 -ip 1792
1⤵
PID:4996

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 784
  2⤵
  PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1532 -ip 1532
1⤵
PID:4516

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 784
  2⤵
  PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4336 -ip 4336
1⤵
PID:4412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:3476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 784
  2⤵
  PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3476 -ip 3476
1⤵
PID:4576

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 784
  2⤵
  PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4828 -ip 4828
1⤵
PID:2948

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 792
  2⤵
  PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2192 -ip 2192
1⤵
PID:4184

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 784
  2⤵
  PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1200 -ip 1200
1⤵
PID:2640

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 768
  2⤵
  PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2440 -ip 2440
1⤵
PID:5112

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 772
  2⤵
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4632 -ip 4632
1⤵
PID:5056

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Drops file in System32 directory
PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 784
  2⤵
  PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4440 -ip 4440
1⤵
PID:1828

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 776
  2⤵
  PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2392 -ip 2392
1⤵
PID:3236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 784
  2⤵
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 416 -ip 416
1⤵
PID:3044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 784
  2⤵
  PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1720 -ip 1720
1⤵
PID:4328

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 784
  2⤵
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4040 -ip 4040
1⤵
PID:872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 760
  2⤵
  PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4152 -ip 4152
1⤵
PID:1464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 788
  2⤵
  PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4808 -ip 4808
1⤵
PID:2652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:1624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 788
  2⤵
  PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1624 -ip 1624
1⤵
PID:1468

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:3508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3508 -s 788
  2⤵
  PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3508 -ip 3508
1⤵
PID:2124

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 784
  2⤵
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4944 -ip 4944
1⤵
PID:4968

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 784
  2⤵
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 444 -ip 444
1⤵
PID:4500

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- System Location Discovery: System Language Discovery
PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 768
  2⤵
  PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4272 -ip 4272
1⤵
PID:4940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:4584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 772
  2⤵
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4584 -ip 4584
1⤵
PID:1136

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2248 -ip 2248
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svchost.exe.txt

Filesize
404B

MD5
db9e7850922f18303bf00422c3a6eb22

SHA1
e96e50e1a13f4169e1fe30833bc9c276a90cce8f

SHA256
6934ca55e3f5302a11c30aece4084c1aacad866ab8205db4d9c4740198a9af02

SHA512
bce370eb86be4ab8cc5718d10ac6db5d4f583c3a4805548871dea5a9309e0533837b8232572994545d35932abd0663dcfffd8c1aea843603da006e87e7b46f9e

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
505B

MD5
7bc780506acd85593313a0caa5a1b9db

SHA1
a3d0d76e75eb7ae63200dad76b943c47bf8c9a97

SHA256
736d24299e70568466af59692d6380a0089b4b2d1f72eb2967b9805e21415127

SHA512
567a767624e3aa8f2f7339de08471ff0a7d82882664b02fcb28da6bae81e3974f4eab619f0f764c2b2552c5113d5669e3ca5614916346aca08044a64647d471a

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
606B

MD5
bd6ed280ffe10a230ea9617022922b69

SHA1
3c51b0afa00e205bbab5e55a8930cfdf0e9e0df2

SHA256
52a77d64ed24dd5082bf7d279280bea0279eb34ff91d289964b911b4116f0662

SHA512
7590d68627607b5dec1a58b6c131bf1dfb0f028364637f5ddcaad424543417eb1703a914bb403f3b6128f4514e83c0b713f4dcee885284576f265c7e74b474c1

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
707B

MD5
a90c36f84c6bd0251d57ecd3ec5a4e20

SHA1
b8deb89723c59999837746c8c8964731b29b91c4

SHA256
8d846b702da2cdc5a5cd0c4c89ae7972cc9058785eb579415b9710763eac8c5d

SHA512
ac4d4a69951fdffaf040d685e45591fd07e43367afa8b551b1003a58dddaecbb402c1de78f77c14362aae5c364fa1ba5db5ce3f0c96f242a31a8514c7642ed0d

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
808B

MD5
995446aca3071cf87464f4fe9cf77272

SHA1
a65e678a0d7686a68f548a8371a5c91a962d823d

SHA256
3d237bf45c97e3588a5cef970e2800616b1e4ecc15ad3f6bcf16990d96697068

SHA512
d1155a5f3918cb6fa89303fc1ea4e1ced216841cae615eb5258e057edb70911b4a7de4faa77907bd39d5c868845bddb317319a20e35e4fbea3514b4d88d89668

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
909B

MD5
6d3348a753e4d7866c195dfdae7b0727

SHA1
00c31237f213e5967f1b349c362b4a2e8f74956c

SHA256
5da0aabac713ec0028b999df68febb6b4d989c393a69b8f97d5c8e59f277d275

SHA512
0512608628f426ee13b1158b6aedebbb28d970e10b6d6febcb806bbbfda6ab7c4ac0584a1fa5caf88180430a02851f1ce67d9fafd359e4134ce482a997d48fea

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
968B

MD5
72b0ef9382690d19543d880f6852d1ac

SHA1
ef143e8e6d05db696d4940b7e62393f81f3b15d6

SHA256
04ca2ddea2173e9565e48b9652b6f7ee9b0d06db47efb0710d91081392a3ff14

SHA512
c44178273566b2058ae392b36357f1ba8373decb32b03fff017d846dc7923c351278f06e304229789b6b98dd87c7bae04f96792f4b9b90cc9dcb6bbce50626f6

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
f16190aafa5a51ca09293b3af23796c8

SHA1
f6a7bb9222506ee434abbd32ec0d9946e8197243

SHA256
fadac5bd597ca15d3876dd44725efb0b86cf1e856120cbb2d1d1b7fa907c2493

SHA512
cc58ae53fc2c760186eebebba0cb67dd1017e410a670910a39810c46778003d2fd19bb3ccd3125edcd2cb81e16d9a8a84b142b07e6cd938598c52b37006f3913

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
ed01de81af1354d3456764d230dc276b

SHA1
8cea54867822c831de69c818a7251477b2aae9fe

SHA256
61ed50f75ea3d4eec378fd3ea84521c2cb34aa9e178612635c4fe2693648b4be

SHA512
befdfb2dde146be8afe36777d9389a94041c7ca45c2045dcdf36dc39576c6aa9d40cf3c9d6d60c27909cfb99fcfea0879427c4579ac166b2110da80be7c1aba7

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
f33a4bd9cedc5ed3ab65c332bc8797d2

SHA1
a01059538f68db6ecb426dc790afaec761b58e47

SHA256
97d69fd4ccc77c8b2f4a8dc54dfd14d3ceb4ccc3df0aefc3c686222e30f1bd35

SHA512
e47836535fea36001a55e44e851f4d9ad8869caf323d0e9de48980707ee534033cad5cb05602996b797929e1f5c382ab4485c2399cb6ad6c0644bf349dd43ee2

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
5ff1af4729ceae39db7320e15417e519

SHA1
8de70bcc58dfde7e0a9c26599d4174f5a9d652ed

SHA256
e322e0800f286221747ab7ed5458f1590f0252768f92e3513832fda00074f8df

SHA512
7ff2f412cb3ba4e4c009de8ddc06ef2da730eeb97c336056698e96bc7fad86a88517adf20adcf1a16c7b8d0486b1e39d03ddbd2b7875ba7d9df2183968e76368

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
3ab0d7e619e4c7f08acd06f269c7c5e5

SHA1
cbe3a2314a46e276fa0ae7730c211c88c19d9174

SHA256
e24e450b36846606471507cffe24bd9079fe6040dc5a72411f1781469add17b2

SHA512
d2e349dd9adf3db15ab4623b92a3388974073a1db30bcb295ab036ff6a2a442d5cc7e22e6cfe8fe36a4bd4ce029c9954d6dc57361098faf91be80b031d2b0792

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
2dbc5ead8464c98be992dc58b4ca4d18

SHA1
5cf7a41fa2db18c4369055ed65e1926d63ba68bd

SHA256
7e271a64203bb02f590d3cb135d72b821c828dca1008db625be3733f5200c85a

SHA512
e9107f120338a00a8e08a12d8fb78069db3c5eeeb5db1ddbc2c9b73eff0679e4639540f2a2728273d353ace891e701a66ef03d01d9e82ceeb83f73fee188191e

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
50ad025d456d2135c33fb284c0624c4c

SHA1
a6536467f75a272b58cdd23b31ed24b2e53c7151

SHA256
dbb0b6c51112626fc0685317f783a1e647f34296594858bec1f81e7b43c20dbe

SHA512
c35d734df72c63b80bd9be26242698a930982537c5879cca7260ee98cda0031bcb738a7f349ce50367dd9576fcecff9e5f05cc545f400ff138d9a0d2b0933be9

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
5008d2cc3e3a147003c49fb5c4e6b9a0

SHA1
6f8528c69ea7a61a299cb961fc738f16f80e977f

SHA256
c90b944d8576b99dffb5a4476770b56b268bbbeeb3335afe64fc24f55d7816ac

SHA512
fe23004d3ec91509bd74ff283ba0373c3e7ae66c2dc555b538828715b3b4f7dd516370613bf9edd3b96d2a2c41a087c30fbc4805ae6d2e6d2f89c0a903533c17

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
9c7840488a54a3347cfa418eb3dc27db

SHA1
f645061f6b0867b66233753555ba8b3568550bae

SHA256
353ae58c8cccd73b3c532e4994c7f69e48852736fafe02fac537f88f211048ed

SHA512
02fd459edf74b4ffda06ec979f81e726bfe15d9ec27ea0412983f19c73aaa42dba0655136626f837a00c3991bf05d1a308de1f1a4bf221bdd9a11c6e815e7ad9

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
202B

MD5
e47c9eaba84c04662930486311b07a22

SHA1
e67eda50a93e8bf15d8ae06b8287b28c5c2ca5d3

SHA256
c44ce07dbd9b41a07d6af737343e22ebe0ba94f52157795495c99a807f26e431

SHA512
111861ac2fa36ac3b595e8b047c8671bff98fce9ce46201b5ca46733752f3f177382ce920598a2e9e806b426f26dcb1a08b43af6c46c1ba687cb2c1404255129

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
1KB

MD5
92d6551f1df29fc938de7db0a015bef2

SHA1
620673131557ea59c5ebc6fb180290e77c9f567f

SHA256
c69c30a33f2f372c5edd8129cbafb14f9454d622b54fec23907f4e932da16aef

SHA512
364055294685556539cd938a104c6dd07effd028519c1d225aa2ebb4dc56145ceaab942c5675bbcecd1b9310585a645228850de24782c63758141a89bae15ed7

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
7b48f25a73f2ea68303270e270b558d7

SHA1
2f821e6ff2ac0d7d5b7533050dd4bcda13e4aff9

SHA256
dd5b10ffb3dd24f64dd44e6c17ce66154bb12a5d03661151a1e059c185ead19b

SHA512
088d07ad3e74537649c75f32f6c64b78ac2281ccc9cba22653a1e7016b8547b73c8e63bb9a82afb08ec63969cfb12d484f4c3e394055a07e04a29f4e2012dfe3

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
58f1d76da90199c1b069a5f186cb77cb

SHA1
dae8033a745825b40c61367a4226cec451135098

SHA256
050e8968437e3e40cb10a7eb4633b08a63e6f67a6deff5a8392a7c20ff1adc9c

SHA512
762d61e8aa83d541b261b05b8daeea557d40525b1f44ff38b7a1562e0f98ef367285bd4f044063e7aa01dda47d13a22da9819aa7c504d7fd342a7363dcaac6a6

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
c8b060938dfb5b26f99275a2d9507e65

SHA1
e06e199fb85ce916ade9a210fe95685530967290

SHA256
ccf46d3bf90a0800b12726e8c20f498901becdc88d40ed010207803a7327731a

SHA512
f02c5a8a936b1d6b42a36d4f1e170aab9835733a24e58f9980e3b09062addd40fa8970212218720ad68bec8a8b801882cdd3f9f9fe55e341da4b07ce9d8d4191

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
d40e70dfd2353ca35f18e896edcb6bda

SHA1
f724f17c4e1c6086b7d4b2f5fed6a44896144f93

SHA256
df87ea88c5db22b6177a8439e321d505d78e924f4c27fc18d575756ae54d7343

SHA512
56c7c4a8984fbfa441ba70390062bd0c861d6321b04429c6ea15e814d20a8661eeae4893aa3d9ec89805747571d54c597bc199cf5b04686801187364d92a63e2

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
707ba49e3e4c297d7145bf140262437a

SHA1
2bf5ebc289135a89805d7de875cbb8e1522e9f10

SHA256
58349b2318457e01a8ba6775954b190a2d1bad2e36aa10b10ab018d3e6c54301

SHA512
6196e3b6f9d75ae51c66652c99c5340a98247ee8065746356a269a795fb4133fc612a3fab8140bb4e34b2e69b398533eed62ae02de9a4dc92e5d04c0f289a2de

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
c211428b16a3d9b4641e26665f2d6776

SHA1
02100380cabdc2d2f27663a129ea39603aa97c16

SHA256
4011b3a45ed69fe67b89718b90832879fc9a49745c0b32d332f28dde961e0008

SHA512
e2a7f8733ddcf10fa0e59ecec2fbd1439855feea4eb2ada7e31a5e18e87f7deb292e09a01fff651285681b023e4c5ec02dfbaff5ebfe1009192872bd41baa206

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
cb381d4b11af8109460a221a0b87611d

SHA1
94aa5bcd0a9d255f573a5a510ef8aa8c37e5fec4

SHA256
a7b3f5aaf01bde1013ef2792642b52e8ab299e5fefd2038ed68638dfd0590d68

SHA512
7b9d91f6024ec0c899d6059d1eb733ba22f53570eabd9edc177d67b168895fd42ce7a0510705831b886ae939fadaa446c01d4c673fb5eb56c5796f5feb9c0e68

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
07ee1a1acd30e71609fed9b4e0f67cc2

SHA1
95bc4e6901e49fb220522819fa4b45949d756773

SHA256
2a582ec5dca1045732d14396d3fa6a8f0f0db1b93a5b516083d5548cc8a20ebd

SHA512
0c0876c97d170fffdb3f0fa46f56649509a0ebeac27d3108897811e346a26e9492fede31d07fab131dbe33201d2f4ec3192e1a554d6b6195846c5b221bd72f59

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
1556372796347dacf30a43f504f99c46

SHA1
abcba58163dd728e56fee06b2d8c69d8c581831b

SHA256
c3b7bc42588695b7fc61333dffb0b3270b1d296f7ca3f6d4e5ba18f37ead1470

SHA512
5ae3b9f24d3797c156d886e942bd1741fb361ae566e683e94b3a45e234e2126ea51c726436c5b456c40bb50d490fb3974a4a6a3bf7975134152b97fcec337f7c

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
2KB

MD5
e882b72663867ecc7c3bb63534f54530

SHA1
fe035751ee89de1506ca3853417776b017737e34

SHA256
93ac84675326f9756cfed82d7e8098413ba553641172b0095268d9d947eeb352

SHA512
2cd959da9ae9c596ba10f02b7c7c4d8cc0263ace5a9e00991c130570cbadd4891cfbbbe94f3b5115084ebc309a9fa56bef1cc545bcdf7044363fb5f858b11013

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
3KB

MD5
43c502cc08a0b34b7f0ce7456de2d243

SHA1
a978e50db2e9db374b926cbf1f1f37f358422a4d

SHA256
fcef0bc614fdaa31910694d888a518bac9b4198d6017d3be37339ce08d437f98

SHA512
f3c1969ad2775393988c924aef8f3896374d7738c45196b580b47082233516c2f678c27f32764a8a3776f2e95feb23e5e50bd73983ea81398bb4fa1fac2abf65

Download Submit
C:\Windows\SysWOW64\svchost.exe.txt

Filesize
3KB

MD5
103f620799132ded53fce238e0f4527a

SHA1
b34ea275f9293c8bfbb4f08bacc058fd870ea928

SHA256
89135a369caae5fcb1756c1bbc0b2c36d8a842a4c130739e0507378036dcc16e

SHA512
b8b79cdae0a016dd04b013e300d0d39a7ea84c869eb2a0e38fe8e793d7cfbe0deebdbb4d55dbdcda5e28ae6aa647ebcd7279ce2eed594f7bc7a4574573096143

Download Submit
\??\c:\windows\microsoft.net\framework\rtqjq.byj

Filesize
584KB

MD5
502221407faa3b2d9c96c8a2b55e87ed

SHA1
5458e74b2f30fb3e12369590e405e0c7d504db5c

SHA256
0e22824a22e6332e21e6e5a5aabcdf30d777cfbcfb8a306262ec07cfa404dd5d

SHA512
b24d7d0163871b03b98979f293386e626e2a720dab14eaca12a50b4583ddda4abe27508c85f7054aae3825527fdf88af654deef4985f4e854d39af916c1e5724

Download Submit
memory/228-19-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/404-31-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/456-37-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/456-88-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/472-91-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/700-73-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/700-22-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/772-118-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1380-99-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1420-108-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1504-128-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1552-126-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1596-61-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1624-52-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1720-117-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1792-127-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1840-110-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1920-40-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2016-28-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2120-123-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2148-101-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2204-76-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2500-116-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2504-109-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/2760-67-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3020-122-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3052-104-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3096-10-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3112-100-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3116-79-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3312-125-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3404-124-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3416-58-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3448-120-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3472-112-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3608-4-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3644-129-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3676-98-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3760-115-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/3976-46-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4008-102-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4020-107-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4040-97-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4080-43-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4100-7-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4164-119-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4184-114-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4320-111-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4336-70-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4340-49-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4372-113-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4568-64-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4632-34-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4632-85-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4744-13-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4852-25-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4872-121-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4892-82-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4912-94-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4944-55-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4952-16-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4952-106-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4960-103-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/4972-105-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download