rhadamanthys | hxxps://vdeokompany[.]com/Installer[.]exe

Analysis

max time kernel
1791s
max time network
1793s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://vdeokompany.com/Installer.exe

Score

10^/10

rhadamanthys execution stealer

Malware Config

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 64 IoCs

Processes:

BitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exe

description	pid	process	target process
PID 5936 created 3044	5936	BitLockerToGo.exe	sihost.exe
PID 5944 created 3044	5944	BitLockerToGo.exe	sihost.exe
PID 1596 created 3044	1596	BitLockerToGo.exe	sihost.exe
PID 4556 created 3044	4556	BitLockerToGo.exe	sihost.exe
PID 4820 created 3044	4820	BitLockerToGo.exe	sihost.exe
PID 5756 created 3044	5756	BitLockerToGo.exe	sihost.exe
PID 6064 created 3044	6064	BitLockerToGo.exe	sihost.exe
PID 4896 created 3044	4896	BitLockerToGo.exe	sihost.exe
PID 5416 created 3044	5416	BitLockerToGo.exe	sihost.exe
PID 2200 created 3044	2200	BitLockerToGo.exe	sihost.exe
PID 5844 created 3044	5844	BitLockerToGo.exe	sihost.exe
PID 4564 created 3044	4564	BitLockerToGo.exe	sihost.exe
PID 3352 created 3044	3352	BitLockerToGo.exe	sihost.exe
PID 3728 created 3044	3728	BitLockerToGo.exe	sihost.exe
PID 5908 created 3044	5908	BitLockerToGo.exe	sihost.exe
PID 5916 created 3044	5916	BitLockerToGo.exe	sihost.exe
PID 5748 created 3044	5748	BitLockerToGo.exe	sihost.exe
PID 692 created 3044	692	BitLockerToGo.exe	sihost.exe
PID 4092 created 3044	4092	BitLockerToGo.exe	sihost.exe
PID 5476 created 3044	5476	BitLockerToGo.exe	sihost.exe
PID 5292 created 3044	5292	BitLockerToGo.exe	sihost.exe
PID 2604 created 3044	2604	BitLockerToGo.exe	sihost.exe
PID 5704 created 3044	5704	BitLockerToGo.exe	sihost.exe
PID 5180 created 3044	5180	BitLockerToGo.exe	sihost.exe
PID 5920 created 3044	5920	BitLockerToGo.exe	sihost.exe
PID 3808 created 3044	3808	BitLockerToGo.exe	sihost.exe
PID 1740 created 3044	1740	BitLockerToGo.exe	sihost.exe
PID 1124 created 3044	1124	BitLockerToGo.exe	sihost.exe
PID 3024 created 3044	3024	BitLockerToGo.exe	sihost.exe
PID 5196 created 3044	5196	BitLockerToGo.exe	sihost.exe
PID 3640 created 3044	3640	BitLockerToGo.exe	sihost.exe
PID 6076 created 3044	6076	BitLockerToGo.exe	sihost.exe
PID 1572 created 3044	1572	BitLockerToGo.exe	sihost.exe
PID 1780 created 3044	1780	BitLockerToGo.exe	sihost.exe
PID 5316 created 3044	5316	BitLockerToGo.exe	sihost.exe
PID 3948 created 3044	3948	BitLockerToGo.exe	sihost.exe
PID 5556 created 3044	5556	BitLockerToGo.exe	sihost.exe
PID 5272 created 3044	5272	BitLockerToGo.exe	sihost.exe
PID 3460 created 3044	3460	BitLockerToGo.exe	sihost.exe
PID 2632 created 3044	2632	BitLockerToGo.exe	sihost.exe
PID 872 created 3044	872	BitLockerToGo.exe	sihost.exe
PID 5804 created 3044	5804	BitLockerToGo.exe	sihost.exe
PID 5256 created 3044	5256	BitLockerToGo.exe	sihost.exe
PID 5192 created 3044	5192	BitLockerToGo.exe	sihost.exe
PID 1740 created 3044	1740	BitLockerToGo.exe	sihost.exe
PID 452 created 3044	452	BitLockerToGo.exe	sihost.exe
PID 2024 created 3044	2024	BitLockerToGo.exe	sihost.exe
PID 2212 created 3044	2212	BitLockerToGo.exe	sihost.exe
PID 5804 created 3044	5804	BitLockerToGo.exe	sihost.exe
PID 3516 created 3044	3516	BitLockerToGo.exe	sihost.exe
PID 4584 created 3044	4584	BitLockerToGo.exe	sihost.exe
PID 3552 created 3044	3552	BitLockerToGo.exe	sihost.exe
PID 5896 created 3044	5896	BitLockerToGo.exe	sihost.exe
PID 5484 created 3044	5484	BitLockerToGo.exe	sihost.exe
PID 5616 created 3044	5616	BitLockerToGo.exe	sihost.exe
PID 1396 created 3044	1396	BitLockerToGo.exe	sihost.exe
PID 1152 created 3044	1152	BitLockerToGo.exe	sihost.exe
PID 5496 created 3044	5496	BitLockerToGo.exe	sihost.exe
PID 2964 created 3044	2964	BitLockerToGo.exe	sihost.exe
PID 5240 created 3044	5240	BitLockerToGo.exe	sihost.exe
PID 4884 created 3044	4884	BitLockerToGo.exe	sihost.exe
PID 5896 created 3044	5896	BitLockerToGo.exe	sihost.exe
PID 2204 created 3044	2204	BitLockerToGo.exe	sihost.exe
PID 5988 created 3044	5988	BitLockerToGo.exe	sihost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

4060 powershell.exe
Downloads MZ/PE file

pid	process
4060	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

Installer.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exe

pid	process
1660	Installer.exe
5336	update1404.exe
5464	update1404.exe
5552	update1404.exe
5644	update1404.exe
5716	update1404.exe
5820	update1404.exe
5900	update1404.exe
4528	update1404.exe
5640	update1404.exe
5864	update1404.exe
5972	update1404.exe
1276	update1404.exe
5516	update1404.exe
5780	update1404.exe
6040	update1404.exe
5892	update1404.exe
5656	update1404.exe
2192	update1404.exe
1496	update1404.exe
5792	update1404.exe
5860	update1404.exe
6056	update1404.exe
3136	update1404.exe
1704	update1404.exe
5716	update1404.exe
5128	update1404.exe
1536	update1404.exe
5840	update1404.exe
6136	update1404.exe
3712	update1404.exe
5720	update1404.exe
2400	update1404.exe
5532	update1404.exe
3960	update1404.exe
4132	update1404.exe
3952	update1404.exe
980	update1404.exe
5220	update1404.exe
5204	update1404.exe
4684	update1404.exe
5908	update1404.exe
1124	update1404.exe
4100	update1404.exe
5452	update1404.exe
5352	update1404.exe
5940	update1404.exe
5020	update1404.exe
5384	update1404.exe
5764	update1404.exe
1572	update1404.exe
3808	update1404.exe
4692	update1404.exe
1608	update1404.exe
3948	update1404.exe
5888	update1404.exe
5660	update1404.exe
1440	update1404.exe
5744	update1404.exe
1600	update1404.exe
3012	update1404.exe
872	update1404.exe
2780	update1404.exe
5552	update1404.exe

Loads dropped DLL 3 IoCs

Processes:

Installer.exe

pid process

1660 Installer.exe
1660 Installer.exe
1660 Installer.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

update1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exeupdate1404.exe

description	pid	process	target process
PID 5336 set thread context of 5936	5336	update1404.exe	BitLockerToGo.exe
PID 5464 set thread context of 5944	5464	update1404.exe	BitLockerToGo.exe
PID 5552 set thread context of 4556	5552	update1404.exe	BitLockerToGo.exe
PID 5644 set thread context of 1596	5644	update1404.exe	BitLockerToGo.exe
PID 5716 set thread context of 4820	5716	update1404.exe	BitLockerToGo.exe
PID 5820 set thread context of 5756	5820	update1404.exe	BitLockerToGo.exe
PID 5900 set thread context of 6064	5900	update1404.exe	BitLockerToGo.exe
PID 4528 set thread context of 4896	4528	update1404.exe	BitLockerToGo.exe
PID 5640 set thread context of 5416	5640	update1404.exe	BitLockerToGo.exe
PID 5864 set thread context of 2200	5864	update1404.exe	BitLockerToGo.exe
PID 5972 set thread context of 5844	5972	update1404.exe	BitLockerToGo.exe
PID 5516 set thread context of 4564	5516	update1404.exe	BitLockerToGo.exe
PID 1276 set thread context of 3352	1276	update1404.exe	BitLockerToGo.exe
PID 5780 set thread context of 3728	5780	update1404.exe	BitLockerToGo.exe
PID 6040 set thread context of 5908	6040	update1404.exe	BitLockerToGo.exe
PID 5892 set thread context of 5916	5892	update1404.exe	BitLockerToGo.exe
PID 5656 set thread context of 5748	5656	update1404.exe	BitLockerToGo.exe
PID 2192 set thread context of 692	2192	update1404.exe	BitLockerToGo.exe
PID 1496 set thread context of 4092	1496	update1404.exe	BitLockerToGo.exe
PID 5792 set thread context of 5476	5792	update1404.exe	BitLockerToGo.exe
PID 5860 set thread context of 3016	5860	update1404.exe	BitLockerToGo.exe
PID 6056 set thread context of 5292	6056	update1404.exe	BitLockerToGo.exe
PID 3136 set thread context of 2604	3136	update1404.exe	BitLockerToGo.exe
PID 1704 set thread context of 5704	1704	update1404.exe	BitLockerToGo.exe
PID 5128 set thread context of 5180	5128	update1404.exe	BitLockerToGo.exe
PID 5716 set thread context of 5920	5716	update1404.exe	BitLockerToGo.exe
PID 1536 set thread context of 3808	1536	update1404.exe	BitLockerToGo.exe
PID 5840 set thread context of 1740	5840	update1404.exe	BitLockerToGo.exe
PID 6136 set thread context of 1124	6136	update1404.exe	BitLockerToGo.exe
PID 5720 set thread context of 3024	5720	update1404.exe	BitLockerToGo.exe
PID 3712 set thread context of 1228	3712	update1404.exe	BitLockerToGo.exe
PID 2400 set thread context of 5196	2400	update1404.exe	BitLockerToGo.exe
PID 5532 set thread context of 3640	5532	update1404.exe	BitLockerToGo.exe
PID 3960 set thread context of 6076	3960	update1404.exe	BitLockerToGo.exe
PID 4132 set thread context of 1572	4132	update1404.exe	BitLockerToGo.exe
PID 980 set thread context of 1780	980	update1404.exe	BitLockerToGo.exe
PID 3952 set thread context of 5180	3952	update1404.exe	BitLockerToGo.exe
PID 5220 set thread context of 5316	5220	update1404.exe	BitLockerToGo.exe
PID 5204 set thread context of 3948	5204	update1404.exe	BitLockerToGo.exe
PID 4684 set thread context of 5556	4684	update1404.exe	BitLockerToGo.exe
PID 5908 set thread context of 5272	5908	update1404.exe	BitLockerToGo.exe
PID 1124 set thread context of 3460	1124	update1404.exe	BitLockerToGo.exe
PID 5452 set thread context of 2632	5452	update1404.exe	BitLockerToGo.exe
PID 4100 set thread context of 872	4100	update1404.exe	BitLockerToGo.exe
PID 5352 set thread context of 5804	5352	update1404.exe	BitLockerToGo.exe
PID 5940 set thread context of 5256	5940	update1404.exe	BitLockerToGo.exe
PID 5020 set thread context of 5192	5020	update1404.exe	BitLockerToGo.exe
PID 5384 set thread context of 1740	5384	update1404.exe	BitLockerToGo.exe
PID 5764 set thread context of 452	5764	update1404.exe	BitLockerToGo.exe
PID 1572 set thread context of 2024	1572	update1404.exe	BitLockerToGo.exe
PID 3808 set thread context of 2212	3808	update1404.exe	BitLockerToGo.exe
PID 4692 set thread context of 5804	4692	update1404.exe	BitLockerToGo.exe
PID 1608 set thread context of 3516	1608	update1404.exe	BitLockerToGo.exe
PID 3948 set thread context of 4584	3948	update1404.exe	BitLockerToGo.exe
PID 5660 set thread context of 3552	5660	update1404.exe	BitLockerToGo.exe
PID 5888 set thread context of 5896	5888	update1404.exe	BitLockerToGo.exe
PID 1440 set thread context of 5484	1440	update1404.exe	BitLockerToGo.exe
PID 5744 set thread context of 5616	5744	update1404.exe	BitLockerToGo.exe
PID 1600 set thread context of 1396	1600	update1404.exe	BitLockerToGo.exe
PID 3012 set thread context of 1152	3012	update1404.exe	BitLockerToGo.exe
PID 872 set thread context of 5496	872	update1404.exe	BitLockerToGo.exe
PID 2780 set thread context of 2964	2780	update1404.exe	BitLockerToGo.exe
PID 5552 set thread context of 5240	5552	update1404.exe	BitLockerToGo.exe
PID 1140 set thread context of 5076	1140	update1404.exe	BitLockerToGo.exe

Drops file in Program Files directory 3 IoCs

Processes:

Installer.exe

description	ioc	process
File created	C:\Program Files\launcher289\update1404.zip	Installer.exe
File created	C:\Program Files\launcher289\update1404.exe	Installer.exe
File opened for modification	C:\Program Files\launcher289\update1404.exe	Installer.exe

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5192	5936	WerFault.exe	BitLockerToGo.exe
5200	5944	WerFault.exe	BitLockerToGo.exe
3020	5944	WerFault.exe	BitLockerToGo.exe
980	1596	WerFault.exe	BitLockerToGo.exe
5284	5936	WerFault.exe	BitLockerToGo.exe
5612	4556	WerFault.exe	BitLockerToGo.exe
2704	1596	WerFault.exe	BitLockerToGo.exe
5780	4820	WerFault.exe	BitLockerToGo.exe
692	4556	WerFault.exe	BitLockerToGo.exe
3992	4820	WerFault.exe	BitLockerToGo.exe
6092	5756	WerFault.exe	BitLockerToGo.exe
5196	5756	WerFault.exe	BitLockerToGo.exe
5384	6064	WerFault.exe	BitLockerToGo.exe
4564	6064	WerFault.exe	BitLockerToGo.exe
4780	4896	WerFault.exe	BitLockerToGo.exe
4660	4896	WerFault.exe	BitLockerToGo.exe
5724	5416	WerFault.exe	BitLockerToGo.exe
3576	5416	WerFault.exe	BitLockerToGo.exe
5500	2200	WerFault.exe	BitLockerToGo.exe
5992	2200	WerFault.exe	BitLockerToGo.exe
5204	5844	WerFault.exe	BitLockerToGo.exe
5552	5844	WerFault.exe	BitLockerToGo.exe
5276	4564	WerFault.exe	BitLockerToGo.exe
5828	4564	WerFault.exe	BitLockerToGo.exe
3020	3352	WerFault.exe	BitLockerToGo.exe
3216	3352	WerFault.exe	BitLockerToGo.exe
4104	3728	WerFault.exe	BitLockerToGo.exe
5636	3728	WerFault.exe	BitLockerToGo.exe
5992	5908	WerFault.exe	BitLockerToGo.exe
5820	5908	WerFault.exe	BitLockerToGo.exe
2908	5916	WerFault.exe	BitLockerToGo.exe
3848	5916	WerFault.exe	BitLockerToGo.exe
4896	5748	WerFault.exe	BitLockerToGo.exe
5616	5748	WerFault.exe	BitLockerToGo.exe
5416	692	WerFault.exe	BitLockerToGo.exe
1064	692	WerFault.exe	BitLockerToGo.exe
5384	4092	WerFault.exe	BitLockerToGo.exe
5484	4092	WerFault.exe	BitLockerToGo.exe
1528	5476	WerFault.exe	BitLockerToGo.exe
2172	3016	WerFault.exe	BitLockerToGo.exe
5412	5476	WerFault.exe	BitLockerToGo.exe
3808	3016	WerFault.exe	BitLockerToGo.exe
2080	5292	WerFault.exe	BitLockerToGo.exe
228	5292	WerFault.exe	BitLockerToGo.exe
3012	2604	WerFault.exe	BitLockerToGo.exe
832	2604	WerFault.exe	BitLockerToGo.exe
4840	5704	WerFault.exe	BitLockerToGo.exe
5488	5704	WerFault.exe	BitLockerToGo.exe
5576	5180	WerFault.exe	BitLockerToGo.exe
4304	5180	WerFault.exe	BitLockerToGo.exe
3848	5920	WerFault.exe	BitLockerToGo.exe
5412	5920	WerFault.exe	BitLockerToGo.exe
3252	3808	WerFault.exe	BitLockerToGo.exe
3640	3808	WerFault.exe	BitLockerToGo.exe
5688	1740	WerFault.exe	BitLockerToGo.exe
2704	1740	WerFault.exe	BitLockerToGo.exe
4972	1124	WerFault.exe	BitLockerToGo.exe
5764	1124	WerFault.exe	BitLockerToGo.exe
5368	3024	WerFault.exe	BitLockerToGo.exe
4584	1228	WerFault.exe	BitLockerToGo.exe
5508	3024	WerFault.exe	BitLockerToGo.exe
5132	1228	WerFault.exe	BitLockerToGo.exe
676	5196	WerFault.exe	BitLockerToGo.exe
5360	5196	WerFault.exe	BitLockerToGo.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644114144563715"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exepowershell.exeInstaller.exeBitLockerToGo.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeopenwith.exeBitLockerToGo.exeopenwith.exe

pid	process
2468	chrome.exe
2468	chrome.exe
4060	powershell.exe
4060	powershell.exe
4060	powershell.exe
1660	Installer.exe
1660	Installer.exe
1660	Installer.exe
1660	Installer.exe
1660	Installer.exe
1660	Installer.exe
1660	Installer.exe
5936	BitLockerToGo.exe
5936	BitLockerToGo.exe
5944	BitLockerToGo.exe
5944	BitLockerToGo.exe
6056	openwith.exe
6056	openwith.exe
6056	openwith.exe
6056	openwith.exe
1660	Installer.exe
1596	BitLockerToGo.exe
1596	BitLockerToGo.exe
4556	BitLockerToGo.exe
4556	BitLockerToGo.exe
5420	openwith.exe
5420	openwith.exe
5420	openwith.exe
5420	openwith.exe
1660	Installer.exe
4820	BitLockerToGo.exe
4820	BitLockerToGo.exe
2576	openwith.exe
2576	openwith.exe
2576	openwith.exe
2576	openwith.exe
1660	Installer.exe
1660	Installer.exe
5756	BitLockerToGo.exe
5756	BitLockerToGo.exe
5152	openwith.exe
5152	openwith.exe
5152	openwith.exe
5152	openwith.exe
6064	BitLockerToGo.exe
6064	BitLockerToGo.exe
5200	openwith.exe
5200	openwith.exe
5200	openwith.exe
5200	openwith.exe
4896	BitLockerToGo.exe
4896	BitLockerToGo.exe
5752	openwith.exe
5752	openwith.exe
5752	openwith.exe
5752	openwith.exe
1660	Installer.exe
1660	Installer.exe
5416	BitLockerToGo.exe
5416	BitLockerToGo.exe
5396	openwith.exe
5396	openwith.exe
5396	openwith.exe
5396	openwith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

chrome.exe

pid process

2468 chrome.exe
2468 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeInstaller.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeDebugPrivilege	1660	Installer.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe
Token: SeShutdownPrivilege	2468	chrome.exe
Token: SeCreatePagefilePrivilege	2468	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

Processes:

chrome.exe

pid	process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe
2468	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

Installer.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exeBitLockerToGo.exe

pid	process
1660	Installer.exe
5936	BitLockerToGo.exe
5944	BitLockerToGo.exe
4556	BitLockerToGo.exe
1596	BitLockerToGo.exe
4820	BitLockerToGo.exe
5756	BitLockerToGo.exe
6064	BitLockerToGo.exe
4896	BitLockerToGo.exe
5416	BitLockerToGo.exe
2200	BitLockerToGo.exe
5844	BitLockerToGo.exe
4564	BitLockerToGo.exe
3352	BitLockerToGo.exe
3728	BitLockerToGo.exe
5908	BitLockerToGo.exe
5916	BitLockerToGo.exe
5748	BitLockerToGo.exe
692	BitLockerToGo.exe
4092	BitLockerToGo.exe
5476	BitLockerToGo.exe
3016	BitLockerToGo.exe
5292	BitLockerToGo.exe
2604	BitLockerToGo.exe
5704	BitLockerToGo.exe
5180	BitLockerToGo.exe
5920	BitLockerToGo.exe
3808	BitLockerToGo.exe
1740	BitLockerToGo.exe
1124	BitLockerToGo.exe
3024	BitLockerToGo.exe
1228	BitLockerToGo.exe
5196	BitLockerToGo.exe
3640	BitLockerToGo.exe
6076	BitLockerToGo.exe
1572	BitLockerToGo.exe
1780	BitLockerToGo.exe
5180	BitLockerToGo.exe
5316	BitLockerToGo.exe
3948	BitLockerToGo.exe
5556	BitLockerToGo.exe
5272	BitLockerToGo.exe
3460	BitLockerToGo.exe
2632	BitLockerToGo.exe
872	BitLockerToGo.exe
5804	BitLockerToGo.exe
5256	BitLockerToGo.exe
5192	BitLockerToGo.exe
1740	BitLockerToGo.exe
452	BitLockerToGo.exe
2024	BitLockerToGo.exe
2212	BitLockerToGo.exe
5804	BitLockerToGo.exe
3516	BitLockerToGo.exe
4584	BitLockerToGo.exe
3552	BitLockerToGo.exe
5896	BitLockerToGo.exe
5484	BitLockerToGo.exe
5616	BitLockerToGo.exe
1396	BitLockerToGo.exe
1152	BitLockerToGo.exe
5496	BitLockerToGo.exe
2964	BitLockerToGo.exe
5240	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2468 wrote to memory of 888	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 888	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2208	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 3996	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 3996	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe
PID 2468 wrote to memory of 2336	2468	chrome.exe	chrome.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3044

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6056

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6072

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5420

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4636

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5152

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5200

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5752

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5396

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5372

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5932

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5280

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5128

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3468

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5952

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3628

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:424

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1244

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4816

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5844

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5940

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4504

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5260

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2504

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3336

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6048

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5172

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:692

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5804

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5844

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4036

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2004

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5816

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5924

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5480

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3468

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5448

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1264

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5980

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5544

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4936

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:688

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1272

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3492

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2840

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6108

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4032

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5476

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5616

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4236

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5316

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:396

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4556

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2132

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6048

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5672

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5332

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5424

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3352

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:900

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3444

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2792

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3324

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3672

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6076

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5696

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:968

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4680

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3992

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5456

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5836

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5328

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5896

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3984

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3532

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4580

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4848

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5748

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2564

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2792

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5896

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3020

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5672

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1820

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1656

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3216

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5988

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4816

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5328

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5124

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3640

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4892

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5876

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3024

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2108

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1080

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5096

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5168

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2792

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1580

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2248

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4524

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4020

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:728

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6048

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5688

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5076

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5184

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5360

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1404

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3552

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4476

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1064

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:380

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5096

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3728

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3344

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1520

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3516

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3552

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:1580

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4448

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3676

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:380

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:8

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3788

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4712

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5300

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3692

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4428

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:6048

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:3576

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:2960

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5140

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:5144

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vdeokompany.com/Installer.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8be60ab58,0x7ff8be60ab68,0x7ff8be60ab78
2⤵
PID:888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:2
2⤵
PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:2336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:1
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:1
2⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4648 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:3712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4800 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:3016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:2888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4888 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:2524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5060 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:1192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:8
2⤵
PID:3012

C:\Users\Admin\Downloads\Installer.exe
"C:\Users\Admin\Downloads\Installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:/'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5336

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 480
5⤵
- Program crash
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 508
5⤵
- Program crash
PID:5284

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5464

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 452
5⤵
- Program crash
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 476
5⤵
- Program crash
PID:3020

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5552

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 476
5⤵
- Program crash
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 472
5⤵
- Program crash
PID:692

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5644

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 476
5⤵
- Program crash
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 472
5⤵
- Program crash
PID:2704

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5716

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 476
5⤵
- Program crash
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 504
5⤵
- Program crash
PID:3992

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5820

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 476
5⤵
- Program crash
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 472
5⤵
- Program crash
PID:5196

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5900

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 472
5⤵
- Program crash
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 504
5⤵
- Program crash
PID:4564

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4528

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 476
5⤵
- Program crash
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 472
5⤵
- Program crash
PID:4660

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5640

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 480
5⤵
- Program crash
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 456
5⤵
- Program crash
PID:3576

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5864

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 472
5⤵
- Program crash
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 476
5⤵
- Program crash
PID:5992

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5972

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 452
5⤵
- Program crash
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 476
5⤵
- Program crash
PID:5552

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1276

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 452
5⤵
- Program crash
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 436
5⤵
- Program crash
PID:3216

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5516

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 364
5⤵
- Program crash
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 480
5⤵
- Program crash
PID:5828

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5780

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 476
5⤵
- Program crash
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 452
5⤵
- Program crash
PID:5636

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6040

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 476
5⤵
- Program crash
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 472
5⤵
- Program crash
PID:5820

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5892

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 476
5⤵
- Program crash
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 472
5⤵
- Program crash
PID:3848

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5656

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 476
5⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 472
5⤵
- Program crash
PID:5616

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2192

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 476
5⤵
- Program crash
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 472
5⤵
- Program crash
PID:1064

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1496

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 476
5⤵
- Program crash
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 504
5⤵
- Program crash
PID:5484

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5792

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 480
5⤵
- Program crash
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 504
5⤵
- Program crash
PID:5412

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5860

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 440
5⤵
- Program crash
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 464
5⤵
- Program crash
PID:3808

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6056

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 476
5⤵
- Program crash
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 472
5⤵
- Program crash
PID:228

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3136

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 476
5⤵
- Program crash
PID:3012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 472
5⤵
- Program crash
PID:832

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1704

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 476
5⤵
- Program crash
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 472
5⤵
- Program crash
PID:5488

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5716

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 476
5⤵
- Program crash
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 512
5⤵
- Program crash
PID:5412

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5128

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 476
5⤵
- Program crash
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 480
5⤵
- Program crash
PID:4304

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1536

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 476
5⤵
- Program crash
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 472
5⤵
- Program crash
PID:3640

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5840

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 476
5⤵
- Program crash
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 472
5⤵
- Program crash
PID:2704

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6136

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 472
5⤵
- Program crash
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 476
5⤵
- Program crash
PID:5764

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3712

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 440
5⤵
- Program crash
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 448
5⤵
- Program crash
PID:5132

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5720

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 436
5⤵
- Program crash
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 480
5⤵
- Program crash
PID:5508

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2400

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 476
5⤵
- Program crash
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 472
5⤵
- Program crash
PID:5360

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5532

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 476
5⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 504
5⤵
PID:1620

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3960

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 476
5⤵
PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 508
5⤵
PID:5832

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4132

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 476
5⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 472
5⤵
PID:6032

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3952

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:5180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 440
5⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5180 -s 460
5⤵
PID:5528

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:980

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 476
5⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 472
5⤵
PID:1264

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5220

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 476
5⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 504
5⤵
PID:4392

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5204

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 476
5⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 472
5⤵
PID:396

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4684

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 476
5⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 472
5⤵
PID:4304

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5908

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 476
5⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 504
5⤵
PID:2132

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1124

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 476
5⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 472
5⤵
PID:1196

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4100

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 480
5⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 472
5⤵
PID:3564

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5452

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 476
5⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 472
5⤵
PID:5184

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5352

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 476
5⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 472
5⤵
PID:1432

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5940

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 452
5⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 476
5⤵
PID:5932

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5020

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 476
5⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 508
5⤵
PID:1600

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5384

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 452
5⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 476
5⤵
PID:2604

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5764

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 476
5⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 472
5⤵
PID:4588

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1572

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 484
5⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 476
5⤵
PID:5084

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3808

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 476
5⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 508
5⤵
PID:5404

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4692

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 476
5⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 512
5⤵
PID:712

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1608

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 216
5⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 480
5⤵
PID:5224

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3948

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 452
5⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 476
5⤵
PID:2272

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5888

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 476
5⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 472
5⤵
PID:1528

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5660

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 436
5⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 480
5⤵
PID:5260

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1440

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 476
5⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 472
5⤵
PID:2172

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5744

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 452
5⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 476
5⤵
PID:1384

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1600

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 452
5⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 476
5⤵
PID:1852

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3012

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 480
5⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 476
5⤵
PID:5748

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:872

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 476
5⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 472
5⤵
PID:5932

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2780

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 476
5⤵
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 472
5⤵
PID:5664

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5552

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetWindowsHookEx
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 476
5⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 512
5⤵
PID:424

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
- Suspicious use of SetThreadContext
PID:1140

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 440
5⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 448
5⤵
PID:2180

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2272

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 452
5⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 480
5⤵
PID:4428

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5488

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 440
5⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 448
5⤵
PID:2132

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5252

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 368
5⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 476
5⤵
PID:380

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4388

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 472
5⤵
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 504
5⤵
PID:4816

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2904

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 476
5⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 472
5⤵
PID:4936

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5504

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 476
5⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 512
5⤵
PID:2576

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4540

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 472
5⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 476
5⤵
PID:4420

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5188

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 476
5⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 472
5⤵
PID:5880

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2688

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 476
5⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 472
5⤵
PID:5244

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:6100

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 476
5⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 452
5⤵
PID:4844

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5332

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 440
5⤵
PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 436
5⤵
PID:1860

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5484

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 452
5⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 476
5⤵
PID:228

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5560

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 136
5⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 476
5⤵
PID:4720

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4104

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 476
5⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1432 -s 472
5⤵
PID:1328

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5148

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 476
5⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5256 -s 472
5⤵
PID:3964

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2260

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 476
5⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 472
5⤵
PID:5476

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5396

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 368
5⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 476
5⤵
PID:4476

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2964

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 476
5⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 472
5⤵
PID:968

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1396

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 476
5⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 472
5⤵
PID:2012

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3408

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 480
5⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 512
5⤵
PID:2020

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4788

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 476
5⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 472
5⤵
PID:3576

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2004

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 452
5⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 484
5⤵
PID:4584

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5212

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 452
5⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 476
5⤵
PID:1864

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5880

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 216
5⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 488
5⤵
PID:2616

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2716

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 476
5⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 472
5⤵
PID:4592

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4556

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 476
5⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 472
5⤵
PID:1560

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5776

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 476
5⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 472
5⤵
PID:5284

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5708

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 476
5⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 472
5⤵
PID:3244

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5948

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 476
5⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 472
5⤵
PID:5628

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5836

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 480
5⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 504
5⤵
PID:1272

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1604

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 472
5⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 504
5⤵
PID:5448

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5428

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 476
5⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 472
5⤵
PID:3680

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3120

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 476
5⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5600 -s 472
5⤵
PID:1696

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5216

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 476
5⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 472
5⤵
PID:2128

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2000

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 476
5⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 472
5⤵
PID:3216

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1652

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 476
5⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 472
5⤵
PID:1684

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1128

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 476
5⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 472
5⤵
PID:5544

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5672

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 476
5⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 472
5⤵
PID:5688

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3252

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 452
5⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 476
5⤵
PID:2280

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1092

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 452
5⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3244 -s 476
5⤵
PID:5932

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5448

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 476
5⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 472
5⤵
PID:1064

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3716

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 476
5⤵
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 472
5⤵
PID:5300

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5112

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 476
5⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 472
5⤵
PID:1432

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2640

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 480
5⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 476
5⤵
PID:1972

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5876

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 452
5⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 476
5⤵
PID:3144

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1084

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 476
5⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 472
5⤵
PID:2064

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4980

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 476
5⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 472
5⤵
PID:3672

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5824

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 476
5⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 484
5⤵
PID:2976

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5400

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 476
5⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 472
5⤵
PID:1404

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4268

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 480
5⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6072 -s 476
5⤵
PID:1384

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3308

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 476
5⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 472
5⤵
PID:3344

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3664

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 476
5⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 472
5⤵
PID:3492

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4068

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 476
5⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 472
5⤵
PID:380

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5600

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 476
5⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 472
5⤵
PID:2416

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5200

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 476
5⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 472
5⤵
PID:5796

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5544

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 476
5⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 504
5⤵
PID:3556

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:212

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 480
5⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 476
5⤵
PID:5420

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2064

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 476
5⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 472
5⤵
PID:3492

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2956

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 476
5⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 472
5⤵
PID:3880

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5168

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 452
5⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 476
5⤵
PID:3180

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2424

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 368
5⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 476
5⤵
PID:2620

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3572

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 452
5⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 476
5⤵
PID:5916

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2128

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 480
5⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 508
5⤵
PID:5432

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1244

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 476
5⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 472
5⤵
PID:2320

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5920

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 452
5⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 476
5⤵
PID:5368

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3024

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 476
5⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 472
5⤵
PID:5924

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5680

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 476
5⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 472
5⤵
PID:8

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:620

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 476
5⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 472
5⤵
PID:6048

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1432

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 480
5⤵
PID:3676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 508
5⤵
PID:5300

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5704

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 476
5⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 472
5⤵
PID:3180

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4564

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 476
5⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 472
5⤵
PID:4248

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4884

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 476
5⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 472
5⤵
PID:5916

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5312

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 452
5⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 476
5⤵
PID:916

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5848

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 476
5⤵
PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5272 -s 452
5⤵
PID:5176

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4264

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 476
5⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 472
5⤵
PID:1580

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3876

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 480
5⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 476
5⤵
PID:4524

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5664

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 476
5⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 512
5⤵
PID:396

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:4844

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 480
5⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 476
5⤵
PID:5796

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:464

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 480
5⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 476
5⤵
PID:4244

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:2620

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:6072

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:1684

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5296

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:5588

C:\Program Files\launcher289\update1404.exe
"C:\Program Files\launcher289\update1404.exe"
3⤵
PID:3500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 --field-trial-handle=1952,i,8540195987720369888,11036504501641242097,131072 /prefetch:2
2⤵
PID:5876

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
1⤵
PID:1652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5936 -ip 5936
1⤵
PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5944 -ip 5944
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5944 -ip 5944
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5936 -ip 5936
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 1596
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4556 -ip 4556
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1596 -ip 1596
1⤵
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4820 -ip 4820
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4556 -ip 4556
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4820 -ip 4820
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5756 -ip 5756
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5756 -ip 5756
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6064 -ip 6064
1⤵
PID:5656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6064 -ip 6064
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4896 -ip 4896
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4896 -ip 4896
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5416 -ip 5416
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5416 -ip 5416
1⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2200 -ip 2200
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2200 -ip 2200
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5844 -ip 5844
1⤵
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5844 -ip 5844
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4564 -ip 4564
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4564 -ip 4564
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3352 -ip 3352
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3352 -ip 3352
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3728 -ip 3728
1⤵
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3728 -ip 3728
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5908 -ip 5908
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5908 -ip 5908
1⤵
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5916 -ip 5916
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5916 -ip 5916
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5748 -ip 5748
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5748 -ip 5748
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 692 -ip 692
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 692 -ip 692
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4092 -ip 4092
1⤵
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4092 -ip 4092
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5476 -ip 5476
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3016 -ip 3016
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5476 -ip 5476
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3016 -ip 3016
1⤵
PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5292 -ip 5292
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5292 -ip 5292
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2604 -ip 2604
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2604 -ip 2604
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5704 -ip 5704
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5704 -ip 5704
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5180 -ip 5180
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5180 -ip 5180
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5920 -ip 5920
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5920 -ip 5920
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3808 -ip 3808
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3808 -ip 3808
1⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1740 -ip 1740
1⤵
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1740 -ip 1740
1⤵
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1124 -ip 1124
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1124 -ip 1124
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3024 -ip 3024
1⤵
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1228 -ip 1228
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3024 -ip 3024
1⤵
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1228 -ip 1228
1⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5196 -ip 5196
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5196 -ip 5196
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3640 -ip 3640
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3640 -ip 3640
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 6076 -ip 6076
1⤵
PID:5384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6076 -ip 6076
1⤵
PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1572 -ip 1572
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1572 -ip 1572
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1780 -ip 1780
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1780 -ip 1780
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5180 -ip 5180
1⤵
PID:1080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5180 -ip 5180
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5316 -ip 5316
1⤵
PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5316 -ip 5316
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3948 -ip 3948
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3948 -ip 3948
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5556 -ip 5556
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5556 -ip 5556
1⤵
PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5272 -ip 5272
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5272 -ip 5272
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3460 -ip 3460
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3460 -ip 3460
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2632 -ip 2632
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2632 -ip 2632
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 872 -ip 872
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 872 -ip 872
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5804 -ip 5804
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5804 -ip 5804
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5256 -ip 5256
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5256 -ip 5256
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5192 -ip 5192
1⤵
PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5192 -ip 5192
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1740 -ip 1740
1⤵
PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1740 -ip 1740
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 452 -ip 452
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 452 -ip 452
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2024 -ip 2024
1⤵
PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2024 -ip 2024
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2212 -ip 2212
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2212 -ip 2212
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5804 -ip 5804
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5804 -ip 5804
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3516 -ip 3516
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3516 -ip 3516
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4584 -ip 4584
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4584 -ip 4584
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3552 -ip 3552
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3552 -ip 3552
1⤵
PID:4636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5896 -ip 5896
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5896 -ip 5896
1⤵
PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5484 -ip 5484
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5484 -ip 5484
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5616 -ip 5616
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5616 -ip 5616
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1396 -ip 1396
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1396 -ip 1396
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1152 -ip 1152
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1152 -ip 1152
1⤵
PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5496 -ip 5496
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5496 -ip 5496
1⤵
PID:5992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2964 -ip 2964
1⤵
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2964 -ip 2964
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5240 -ip 5240
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5240 -ip 5240
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5076 -ip 5076
1⤵
PID:3772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5076 -ip 5076
1⤵
PID:2664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4884 -ip 4884
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4884 -ip 4884
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5828 -ip 5828
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5828 -ip 5828
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5896 -ip 5896
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5896 -ip 5896
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2204 -ip 2204
1⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2204 -ip 2204
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5988 -ip 5988
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5988 -ip 5988
1⤵
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 920 -ip 920
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 920 -ip 920
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5136 -ip 5136
1⤵
PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5136 -ip 5136
1⤵
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1328 -ip 1328
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1328 -ip 1328
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2152 -ip 2152
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2152 -ip 2152
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2548 -ip 2548
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3888 -ip 3888
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2548 -ip 2548
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3888 -ip 3888
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 636 -ip 636
1⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 636 -ip 636
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1264 -ip 1264
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1264 -ip 1264
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1432 -ip 1432
1⤵
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1432 -ip 1432
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5256 -ip 5256
1⤵
PID:460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5256 -ip 5256
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3064 -ip 3064
1⤵
PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3064 -ip 3064
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 4712 -ip 4712
1⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4712 -ip 4712
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1436 -ip 1436
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1436 -ip 1436
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4264 -ip 4264
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4264 -ip 4264
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5272 -ip 5272
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5272 -ip 5272
1⤵
PID:3984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3500 -ip 3500
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3500 -ip 3500
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1384 -ip 1384
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1384 -ip 1384
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 1092 -ip 1092
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1092 -ip 1092
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 3064 -ip 3064
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3064 -ip 3064
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4204 -ip 4204
1⤵
PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 4204 -ip 4204
1⤵
PID:448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5688 -ip 5688
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5688 -ip 5688
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 460 -ip 460
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 460 -ip 460
1⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1580 -ip 1580
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 1580 -ip 1580
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1404 -ip 1404
1⤵
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1404 -ip 1404
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2976 -ip 2976
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2976 -ip 2976
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3380 -ip 3380
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3380 -ip 3380
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3020 -ip 3020
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3020 -ip 3020
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5600 -ip 5600
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5600 -ip 5600
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2640 -ip 2640
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2640 -ip 2640
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2956 -ip 2956
1⤵
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2956 -ip 2956
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1272 -ip 1272
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1272 -ip 1272
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3936 -ip 3936
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3936 -ip 3936
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 244 -ip 244
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 244 -ip 244
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 972 -ip 972
1⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 972 -ip 972
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3024 -ip 3024
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3024 -ip 3024
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3244 -ip 3244
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3244 -ip 3244
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2012 -ip 2012
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2012 -ip 2012
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3348 -ip 3348
1⤵
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3348 -ip 3348
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4580 -ip 4580
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4580 -ip 4580
1⤵
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2504 -ip 2504
1⤵
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2504 -ip 2504
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5304 -ip 5304
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5304 -ip 5304
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3336 -ip 3336
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3336 -ip 3336
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4680 -ip 4680
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4680 -ip 4680
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2248 -ip 2248
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2248 -ip 2248
1⤵
PID:5856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6072 -ip 6072
1⤵
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6072 -ip 6072
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2504 -ip 2504
1⤵
PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2504 -ip 2504
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5688 -ip 5688
1⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5688 -ip 5688
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5176 -ip 5176
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5176 -ip 5176
1⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4032 -ip 4032
1⤵
PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4032 -ip 4032
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3504 -ip 3504
1⤵
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 3504 -ip 3504
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5820 -ip 5820
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5820 -ip 5820
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4188 -ip 4188
1⤵
PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4188 -ip 4188
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2628 -ip 2628
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2628 -ip 2628
1⤵
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6048 -ip 6048
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6048 -ip 6048
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 900 -ip 900
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 900 -ip 900
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3692 -ip 3692
1⤵
PID:712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3692 -ip 3692
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3348 -ip 3348
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3348 -ip 3348
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4428 -ip 4428
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4428 -ip 4428
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3728 -ip 3728
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3728 -ip 3728
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5916 -ip 5916
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5916 -ip 5916
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1852 -ip 1852
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1852 -ip 1852
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5144 -ip 5144
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5144 -ip 5144
1⤵
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3856,i,6593821857742176458,13646536021844995125,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6048 -ip 6048
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6048 -ip 6048
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5924 -ip 5924
1⤵
PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5924 -ip 5924
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2152 -ip 2152
1⤵
PID:1852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2152 -ip 2152
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3696 -ip 3696
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3696 -ip 3696
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5084 -ip 5084
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5084 -ip 5084
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5316 -ip 5316
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5316 -ip 5316
1⤵
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2416 -ip 2416
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2416 -ip 2416
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5272 -ip 5272
1⤵
PID:5588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5272 -ip 5272
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1580 -ip 1580
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 1580 -ip 1580
1⤵
PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6048 -ip 6048
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6048 -ip 6048
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5788 -ip 5788
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5788 -ip 5788
1⤵
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4336 -ip 4336
1⤵
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4336 -ip 4336
1⤵
PID:860

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\launcher289\update1404.exe
Filesize
29.7MB

MD5
aefc6e3e7690eb8da28d2ff2e7906616

SHA1
d7e4b8dd612bf191728b496ddd734a774bbf5f5a

SHA256
71dd1d74f8a4371f911adb5070ae88a4bd9a8eab00338147f021d97d40da784e

SHA512
be92d61950287f8d89ee1176d8f04a638ad207ecb0aceb44fa85d01f057c65d0365006770abf0200398969d9026d7969617fbd6c95c4fcff53ca77e81b72c0c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
096716b804060f0ab0ab92b6fe8cb1a1

SHA1
0b29d7d7da39a4dc07740de8ec27458de57cb521

SHA256
d4403fcaa82090fbe2a3faab0fe3077849e5cef9d47572651539e069448ebccc

SHA512
04604b6891fa734f8766f598dc670bada009be021f30cd4274e3e21bc5755e8e0723e7f468dba52a53a868218e43a5aa8b6931022e4cac2ec652f29d85903d25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
0c83e2c20e95cdc8cab5772e7c4b175a

SHA1
72fcbd9dd56452383f038df43909038229f872ab

SHA256
0b0232373e7f69df6cb79d2f004fc4ae8bb946814f033f8ff65b96243ddad84e

SHA512
f44e5adba6406cd4aab6acfa6bd4b789199c8cf3b8e115ec936c4f0dcc37343c7df50378f6e6970204f7a2f21138c9c2c776f141537d1a295a3d1024b4183d99

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
929B

MD5
f760a0606fc7f0190ffdd3e63f406776

SHA1
1050c015d1cef1e2177fd1d4b9310cc1302c11d8

SHA256
ab22645f591c400d5f3ed683e7e7d468f99ffb82a34f9ed203ef413a60f4ac20

SHA512
9728103d9b0d5cebb7adc2e2d85a64cf03c360c8340796027599c24c0b917efe62490ea92a6bb64dd152c5313acb3af69c20b0c58d68441d05df1ed9ce2191cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
6d5987de3334d45f7e0f8a0d017dace0

SHA1
b8fb5c260fcc04bf699f0a5de857a22a3c8f9840

SHA256
7f28cf6d5127e55872cc46cb7132b97f3cb6124e6acd7f5dc9543ce53ab22874

SHA512
ca8c8d246390756e6fa7a1300b40459519136d82ed207eded987aeffd6b35cc72092796f9f307570b92f71bb924494ad5e69e7937d765450f7017c53ae5a15d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
5344efc8ed7fbb25c4cebc199857bc5a

SHA1
e0ae07f2e760eb1cdead329ca4a59df0be734697

SHA256
21919a1e36c57994cb66f50e2a98a2b2ca7ff2456b1e59a87bd153c19166cfc0

SHA512
6f20f9dd964d736a34b1a8c165dff3f9dc2f5cd8d0b2f378f7bdc3fb5298c595a5a96602ebcce2a6b4539581d68b626f3658ee42ff7f3e1ba2beda4934459adb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
255KB

MD5
ead0f56c4fedc7a635fe139b4fbfc1df

SHA1
69522ed51af885ac488c6b4e6580e85fd396efd7

SHA256
314fd34c4e97ef014cad2a58952afea6c37d77a34bbc1bcba96ef06de61c0056

SHA512
35602a20f2bf591e5b0080fbdc903fbaffac105648b0ce892bd4c7c1bb23f38f53ff1f427c76add1bce5e648300d1a694f082a05601b95656129b4880481be65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
101KB

MD5
8b082fbabb4291572bd7f3702de62f1e

SHA1
625ccf19590445823ed5ba1e1c28c5dac0e44bf6

SHA256
e77cd27f5cc73c39a1ba2e57a661df457d71284249a857542adcbb7a27c5515b

SHA512
3e9dd3834631928c23c4f05185fdb7294e3bc0df9bda5dc20f7592142c404cbaac5958c91bae596c5c8ca3905fdc390fcbc51bb6258ca5e7d52e87371bed9b19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58503e.TMP
Filesize
94KB

MD5
d898e760107b57b2794712a17a18f2f3

SHA1
b1ee0328b56d5ae14df76727397264a45e127848

SHA256
5ad8ff2e505c40d9325031205a2aeb4083c72cdb617c2b6811f377d4307a43d1

SHA512
7cf76112c64b19ab24c7a84dc556b02dfce54c609f4b8f4d7ba4ecdb690862dd94d797b419f2359751a97ab66081bd23fdef10ad9d801a943f7ed8a3899fcb09

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Installer\kNT1bN68GPHErJoZ5BO4atslRG9JT48=\D3DCompiler_47_cor3.dll
Filesize
4.7MB

MD5
a7349236212b0e5cec2978f2cfa49a1a

SHA1
5abb08949162fd1985b89ffad40aaf5fc769017e

SHA256
a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082

SHA512
c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Installer\kNT1bN68GPHErJoZ5BO4atslRG9JT48=\PresentationNative_cor3.dll
Filesize
1.2MB

MD5
e67dff697095b778ab6b76229c005811

SHA1
88a54a3e3ff2bf83a76bbf5df8a0e50bdb36bcdc

SHA256
e92b997f6f3a10b43d3fdc7743307228aa3b0a43430af60ccb06efa154d37e6a

SHA512
6f2a2bbbfa0464537fccb53d40239a294dca8fd477e79d70cd9f74079da48525a300675d3b0daae292432adbb9dd099fd4dc95b6fe2794f4c5f3a7e56e15ef51

Download Submit
C:\Users\Admin\AppData\Local\Temp\.net\Installer\kNT1bN68GPHErJoZ5BO4atslRG9JT48=\wpfgfx_cor3.dll
Filesize
1.9MB

MD5
a71862451605c3fd136c4fa209791815

SHA1
8dd7f71f7d657d24e0d2649a79b9901b8fe99bc1

SHA256
e793bb093c52726090f3590d2abe142e8bc4bdf19796984aef82751ba4b1be6a

SHA512
dbecec9bae98e3d5fe68f9c9a71e3f11322fa3b6b2f9665a377f825ba13c1245d003f484aae62e27c014f4728eaa90d7f24c5ef7ab8baf6e85c7d394c85fae53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dq5hge2v.jvr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\pipe\crashpad_2468_DEKIDQQLTKOQNBTT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1596-211-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/1596-197-0x0000000000D30000-0x0000000000DAE000-memory.dmp

Filesize
504KB

Download
memory/1596-209-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/1596-207-0x0000000003D80000-0x0000000004180000-memory.dmp

Filesize
4.0MB

Download
memory/1596-198-0x0000000000D30000-0x0000000000DAE000-memory.dmp

Filesize
504KB

Download
memory/2576-237-0x0000000002E10000-0x0000000003210000-memory.dmp

Filesize
4.0MB

Download
memory/2576-238-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/2576-240-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/4060-98-0x00007FF8AB3C0000-0x00007FF8ABE81000-memory.dmp

Filesize
10.8MB

Download
memory/4060-104-0x00007FF8AB3C0000-0x00007FF8ABE81000-memory.dmp

Filesize
10.8MB

Download
memory/4060-87-0x00007FF8AB3C3000-0x00007FF8AB3C5000-memory.dmp

Filesize
8KB

Download
memory/4060-88-0x0000026A72190000-0x0000026A721B2000-memory.dmp

Filesize
136KB

Download
memory/4060-99-0x00007FF8AB3C0000-0x00007FF8ABE81000-memory.dmp

Filesize
10.8MB

Download
memory/4528-250-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/4556-214-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/4556-206-0x0000000003720000-0x0000000003B20000-memory.dmp

Filesize
4.0MB

Download
memory/4556-216-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/4556-194-0x00000000007B0000-0x000000000082E000-memory.dmp

Filesize
504KB

Download
memory/4556-193-0x00000000007B0000-0x000000000082E000-memory.dmp

Filesize
504KB

Download
memory/4636-223-0x0000000002E70000-0x0000000003270000-memory.dmp

Filesize
4.0MB

Download
memory/4820-234-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/4820-217-0x0000000000800000-0x000000000087E000-memory.dmp

Filesize
504KB

Download
memory/4820-213-0x0000000000800000-0x000000000087E000-memory.dmp

Filesize
504KB

Download
memory/4820-231-0x0000000003700000-0x0000000003B00000-memory.dmp

Filesize
4.0MB

Download
memory/4820-232-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/5336-142-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5336-168-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5420-226-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/5420-222-0x0000000002530000-0x0000000002930000-memory.dmp

Filesize
4.0MB

Download
memory/5420-224-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/5464-154-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5464-171-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5552-195-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5552-159-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5644-199-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5716-221-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5716-202-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5820-248-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5820-204-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5900-249-0x00007FF6ADDC0000-0x00007FF6AFC0C000-memory.dmp

Filesize
30.3MB

Download
memory/5936-174-0x0000000003630000-0x0000000003A30000-memory.dmp

Filesize
4.0MB

Download
memory/5936-164-0x00000000008C0000-0x000000000093E000-memory.dmp

Filesize
504KB

Download
memory/5936-166-0x00000000008C0000-0x000000000093E000-memory.dmp

Filesize
504KB

Download
memory/5936-181-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/5936-178-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/5936-176-0x0000000003630000-0x0000000003A30000-memory.dmp

Filesize
4.0MB

Download
memory/5944-167-0x0000000000480000-0x00000000004FE000-memory.dmp

Filesize
504KB

Download
memory/5944-177-0x0000000003360000-0x0000000003760000-memory.dmp

Filesize
4.0MB

Download
memory/5944-183-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/5944-180-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/5944-165-0x0000000000480000-0x00000000004FE000-memory.dmp

Filesize
504KB

Download
memory/6056-184-0x0000000000AC0000-0x0000000000AC9000-memory.dmp

Filesize
36KB

Download
memory/6056-188-0x0000000002730000-0x0000000002B30000-memory.dmp

Filesize
4.0MB

Download
memory/6056-190-0x00007FF8CCF30000-0x00007FF8CD125000-memory.dmp

Filesize
2.0MB

Download
memory/6056-192-0x0000000076780000-0x0000000076995000-memory.dmp

Filesize
2.1MB

Download
memory/6072-189-0x0000000002040000-0x0000000002440000-memory.dmp

Filesize
4.0MB

Download