glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (2).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

glupteba metasploit redline smokeloader vidar 1 31.08 norman2 spnewportspectr backdoor dropper evasion infostealer loader stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

37.0.8.88:44263

Extracted

Family

redline

Botnet

31.08

95.181.152.47:15089

Extracted

Family

redline

Botnet

spnewportspectr

135.148.139.222:1594

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral24/memory/748-398-0x0000000004240000-0x0000000004B66000-memory.dmp	family_glupteba
behavioral24/memory/748-418-0x0000000000400000-0x00000000021B4000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 58 IoCs

resource	yara_rule
behavioral24/memory/4476-222-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4476-298-0x00000000055C0000-0x0000000005ABE000-memory.dmp	family_redline
behavioral24/memory/4624-310-0x0000000004CB0000-0x00000000052B6000-memory.dmp	family_redline
behavioral24/memory/4952-308-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4796-297-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/4664-260-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4624-259-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4532-258-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/4204-340-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4460-353-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/5096-384-0x0000000005520000-0x0000000005B26000-memory.dmp	family_redline
behavioral24/memory/4560-392-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4976-387-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4708-410-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/2336-424-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/2452-430-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4708-437-0x0000000004CC0000-0x00000000052C6000-memory.dmp	family_redline
behavioral24/memory/4912-386-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5416-456-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/5532-464-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/5364-453-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5364-474-0x00000000055D0000-0x0000000005BD6000-memory.dmp	family_redline
behavioral24/memory/4952-343-0x0000000004F60000-0x0000000005566000-memory.dmp	family_redline
behavioral24/memory/5096-334-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5688-482-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/5532-487-0x0000000004EE0000-0x00000000054E6000-memory.dmp	family_redline
behavioral24/memory/5812-494-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5824-493-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4532-249-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral24/memory/5912-502-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/5688-508-0x00000000056A0000-0x0000000005CA6000-memory.dmp	family_redline
behavioral24/memory/4468-223-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4452-220-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/4476-218-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral24/memory/4468-219-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral24/memory/4452-216-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral24/memory/5812-522-0x0000000004F80000-0x0000000005586000-memory.dmp	family_redline
behavioral24/memory/5824-523-0x0000000004F50000-0x000000000544E000-memory.dmp	family_redline
behavioral24/memory/6084-527-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/5244-535-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4860-539-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/5136-533-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/6084-552-0x0000000005000000-0x0000000005606000-memory.dmp	family_redline
behavioral24/memory/4860-560-0x0000000004E70000-0x0000000005476000-memory.dmp	family_redline
behavioral24/memory/5244-561-0x0000000005800000-0x0000000005CFE000-memory.dmp	family_redline
behavioral24/memory/3000-559-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/5808-568-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/4248-569-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5144-593-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/5808-590-0x0000000004EB0000-0x00000000053AE000-memory.dmp	family_redline
behavioral24/memory/5512-599-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/5576-602-0x000000000041C5BE-mapping.dmp	family_redline
behavioral24/memory/5436-597-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/5284-645-0x000000000041C5EE-mapping.dmp	family_redline
behavioral24/memory/4588-644-0x000000000041C6A6-mapping.dmp	family_redline
behavioral24/memory/5284-680-0x0000000004E70000-0x0000000005476000-memory.dmp	family_redline
behavioral24/memory/4448-642-0x000000000041C5CA-mapping.dmp	family_redline
behavioral24/memory/5144-624-0x0000000004D30000-0x0000000005336000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral24/memory/2004-215-0x00000000006F0000-0x000000000083A000-memory.dmp	family_vidar
behavioral24/memory/2004-231-0x0000000000400000-0x0000000000593000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 28 IoCs

pid	Process
2856	9cIJOm9TPIteXMa14g3b7H0I.exe
2864	F0PXuqYCMYYNMichy4DjFNSL.exe
2452	WTfTQcom6W_Fwcjh3iaMUoYK.exe
1640	JT7JRqKTRwato5g6WYjnRRoy.exe
2064	wKiZaxOjBTudfaMHdhXgKh7X.exe
2356	n_mNEgTHD8Yp2G5j9NpSOQ01.exe
2164	1WGzN9TtxnzdPO42fA4_Zir7.exe
2168	9nPwBJD8RQr7siP8XyLznMW8.exe
748	OIo_Bc_T9wEx0pRpcoenbn9B.exe
2140	lmaMvVLSlldscTHfY_MsKlQI.exe
1480	XvZ_nJwqtLMTVnoy7_EjCsvw.exe
2004	I0NifhcTNXS6PieWMjjcoYX1.exe
2724	hDjHfuz87XrxmsCjO5LWE0tT.exe
4012	Q_RH4JYun9lNDl1rxQohw8jh.exe
2776	NmGWdfwemX_ARnRJ_GpZjlSu.exe
3976	vhZFt8Sl9dkK_FgxXXuySsrT.exe
1320	_sr_jxMNlDhkUA8zXj4X3NE0.exe
2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe
4444	vhZFt8Sl9dkK_FgxXXuySsrT.exe
4452	XvZ_nJwqtLMTVnoy7_EjCsvw.exe
4468	WTfTQcom6W_Fwcjh3iaMUoYK.exe
4476	1WGzN9TtxnzdPO42fA4_Zir7.exe
4720	JkCeIwDI4mXFP_Mxahb3YBlG.exe
4748	mIIovUdayX9aLVsaQedTtn9P.exe
4596	XvZ_nJwqtLMTVnoy7_EjCsvw.exe
4532	vhZFt8Sl9dkK_FgxXXuySsrT.exe
4624	WTfTQcom6W_Fwcjh3iaMUoYK.exe
4664	1WGzN9TtxnzdPO42fA4_Zir7.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lmaMvVLSlldscTHfY_MsKlQI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lmaMvVLSlldscTHfY_MsKlQI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	n_mNEgTHD8Yp2G5j9NpSOQ01.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	n_mNEgTHD8Yp2G5j9NpSOQ01.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	Setup (2).exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral24/files/0x000100000001ab90-167.dat	themida
behavioral24/files/0x000100000001ab7f-166.dat	themida
behavioral24/files/0x000100000001ab7f-147.dat	themida
behavioral24/files/0x000100000001ab90-141.dat	themida
behavioral24/memory/2140-200-0x0000000000F40000-0x0000000000F41000-memory.dmp	themida
behavioral24/memory/2356-198-0x0000000000DC0000-0x0000000000DC1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	n_mNEgTHD8Yp2G5j9NpSOQ01.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lmaMvVLSlldscTHfY_MsKlQI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
116	ipinfo.io
118	ipinfo.io
293	ipinfo.io
331	ipinfo.io
1656	ipinfo.io
29	ipinfo.io
30	ipinfo.io
112	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2140	lmaMvVLSlldscTHfY_MsKlQI.exe
2356	n_mNEgTHD8Yp2G5j9NpSOQ01.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 4452	1480	XvZ_nJwqtLMTVnoy7_EjCsvw.exe	103
PID 2164 set thread context of 4476	2164	1WGzN9TtxnzdPO42fA4_Zir7.exe	104
PID 2808 set thread context of 4468	2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe	105
PID 3976 set thread context of 4532	3976	vhZFt8Sl9dkK_FgxXXuySsrT.exe	107
PID 2808 set thread context of 4624	2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe	158
PID 2164 set thread context of 4664	2164	1WGzN9TtxnzdPO42fA4_Zir7.exe	157

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 39 IoCs

pid	pid_target	Process	procid_target
4320	4912	WerFault.exe
4040	2168	WerFault.exe	88
5484	748	WerFault.exe	80
5540	2168	WerFault.exe	88
5764	2168	WerFault.exe	88
5804	748	WerFault.exe	80
6068	2168	WerFault.exe	88
4448	748	WerFault.exe	80
5884	5136	WerFault.exe	152
6136	748	WerFault.exe	80
5252	2168	WerFault.exe	88
6572	2168	WerFault.exe	88
5252	6804	WerFault.exe	195
6892	748	WerFault.exe	80
7456	748	WerFault.exe	80
7812	8152	WerFault.exe	239
7448	748	WerFault.exe	80
5424	748	WerFault.exe	80
9544	2004	WerFault.exe	82
9588	5216	WerFault.exe	125
7924	9600	WerFault.exe	296
7720	7056	WerFault.exe	304
11192	10276	WerFault.exe	330
5316	2168	WerFault.exe	88
11288	10320	WerFault.exe	344
12048	12256	WerFault.exe	372
11472	9620	WerFault.exe	375
12576	2168	WerFault.exe	88
684	13244	WerFault.exe	407
13868	13496	WerFault.exe	422
13900	13532	WerFault.exe	423
14124	2168	WerFault.exe	88
15216	748	WerFault.exe	80
9848	15260	WerFault.exe	482
16032	15472	WerFault.exe	492
16864	16404	WerFault.exe	516
16472	17100	WerFault.exe	523
16944	17260	WerFault.exe	534
19116	5356	WerFault.exe	210

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1920	schtasks.exe
4688	schtasks.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
18400	taskkill.exe
9240	taskkill.exe
20352	taskkill.exe
20344	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	350	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1657	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	327	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	Setup (2).exe
1696	Setup (2).exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2724	hDjHfuz87XrxmsCjO5LWE0tT.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2856	1696	Setup (2).exe	92
PID 1696 wrote to memory of 2856	1696	Setup (2).exe	92
PID 1696 wrote to memory of 2856	1696	Setup (2).exe	92
PID 1696 wrote to memory of 2452	1696	Setup (2).exe	93
PID 1696 wrote to memory of 2452	1696	Setup (2).exe	93
PID 1696 wrote to memory of 2452	1696	Setup (2).exe	93
PID 1696 wrote to memory of 2864	1696	Setup (2).exe	91
PID 1696 wrote to memory of 2864	1696	Setup (2).exe	91
PID 1696 wrote to memory of 1640	1696	Setup (2).exe	90
PID 1696 wrote to memory of 1640	1696	Setup (2).exe	90
PID 1696 wrote to memory of 1640	1696	Setup (2).exe	90
PID 1696 wrote to memory of 2064	1696	Setup (2).exe	89
PID 1696 wrote to memory of 2064	1696	Setup (2).exe	89
PID 1696 wrote to memory of 2064	1696	Setup (2).exe	89
PID 1696 wrote to memory of 2356	1696	Setup (2).exe	86
PID 1696 wrote to memory of 2356	1696	Setup (2).exe	86
PID 1696 wrote to memory of 2356	1696	Setup (2).exe	86
PID 1696 wrote to memory of 2164	1696	Setup (2).exe	87
PID 1696 wrote to memory of 2164	1696	Setup (2).exe	87
PID 1696 wrote to memory of 2164	1696	Setup (2).exe	87
PID 1696 wrote to memory of 2168	1696	Setup (2).exe	88
PID 1696 wrote to memory of 2168	1696	Setup (2).exe	88
PID 1696 wrote to memory of 2168	1696	Setup (2).exe	88
PID 1696 wrote to memory of 748	1696	Setup (2).exe	80
PID 1696 wrote to memory of 748	1696	Setup (2).exe	80
PID 1696 wrote to memory of 748	1696	Setup (2).exe	80
PID 1696 wrote to memory of 1480	1696	Setup (2).exe	79
PID 1696 wrote to memory of 1480	1696	Setup (2).exe	79
PID 1696 wrote to memory of 1480	1696	Setup (2).exe	79
PID 1696 wrote to memory of 2140	1696	Setup (2).exe	81
PID 1696 wrote to memory of 2140	1696	Setup (2).exe	81
PID 1696 wrote to memory of 2140	1696	Setup (2).exe	81
PID 1696 wrote to memory of 2004	1696	Setup (2).exe	82
PID 1696 wrote to memory of 2004	1696	Setup (2).exe	82
PID 1696 wrote to memory of 2004	1696	Setup (2).exe	82
PID 1696 wrote to memory of 4012	1696	Setup (2).exe	83
PID 1696 wrote to memory of 4012	1696	Setup (2).exe	83
PID 1696 wrote to memory of 4012	1696	Setup (2).exe	83
PID 1696 wrote to memory of 3976	1696	Setup (2).exe	85
PID 1696 wrote to memory of 3976	1696	Setup (2).exe	85
PID 1696 wrote to memory of 3976	1696	Setup (2).exe	85
PID 1696 wrote to memory of 2776	1696	Setup (2).exe	84
PID 1696 wrote to memory of 2776	1696	Setup (2).exe	84
PID 1696 wrote to memory of 2776	1696	Setup (2).exe	84
PID 1696 wrote to memory of 2724	1696	Setup (2).exe	94
PID 1696 wrote to memory of 2724	1696	Setup (2).exe	94
PID 1696 wrote to memory of 1320	1696	Setup (2).exe	78
PID 1696 wrote to memory of 1320	1696	Setup (2).exe	78
PID 1696 wrote to memory of 1320	1696	Setup (2).exe	78
PID 1696 wrote to memory of 2808	1696	Setup (2).exe	95
PID 1696 wrote to memory of 2808	1696	Setup (2).exe	95
PID 1696 wrote to memory of 2808	1696	Setup (2).exe	95
PID 3976 wrote to memory of 4444	3976	vhZFt8Sl9dkK_FgxXXuySsrT.exe	106
PID 3976 wrote to memory of 4444	3976	vhZFt8Sl9dkK_FgxXXuySsrT.exe	106
PID 3976 wrote to memory of 4444	3976	vhZFt8Sl9dkK_FgxXXuySsrT.exe	106
PID 1480 wrote to memory of 4452	1480	XvZ_nJwqtLMTVnoy7_EjCsvw.exe	103
PID 1480 wrote to memory of 4452	1480	XvZ_nJwqtLMTVnoy7_EjCsvw.exe	103
PID 1480 wrote to memory of 4452	1480	XvZ_nJwqtLMTVnoy7_EjCsvw.exe	103
PID 2808 wrote to memory of 4468	2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe	105
PID 2808 wrote to memory of 4468	2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe	105
PID 2808 wrote to memory of 4468	2808	WTfTQcom6W_Fwcjh3iaMUoYK.exe	105
PID 2164 wrote to memory of 4476	2164	1WGzN9TtxnzdPO42fA4_Zir7.exe	104
PID 2164 wrote to memory of 4476	2164	1WGzN9TtxnzdPO42fA4_Zir7.exe	104
PID 2164 wrote to memory of 4476	2164	1WGzN9TtxnzdPO42fA4_Zir7.exe	104

C:\Users\Admin\AppData\Local\Temp\Setup (2).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\Documents\_sr_jxMNlDhkUA8zXj4X3NE0.exe
  "C:\Users\Admin\Documents\_sr_jxMNlDhkUA8zXj4X3NE0.exe"
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:7028
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:7092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7092.0.2067306350\1705298838" -parentBuildID 20200403170909 -prefsHandle 1516 -prefMapHandle 1508 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 7092 "\\.\pipe\gecko-crash-server-pipe.7092" 1584 gpu
        5⤵
        
        PID:18572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:13372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffdd3c94f50,0x7ffdd3c94f60,0x7ffdd3c94f70
      4⤵
      PID:14324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,12283161285195366799,9426036902967763713,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1664 /prefetch:2
      4⤵
      PID:18796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,12283161285195366799,9426036902967763713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 /prefetch:8
      4⤵
      PID:24052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,12283161285195366799,9426036902967763713,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1736 /prefetch:8
      4⤵
      PID:21308
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1320 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_sr_jxMNlDhkUA8zXj4X3NE0.exe"
    3⤵
    PID:19916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1320
      4⤵
      Kills process with taskkill
      PID:20344
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1320 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_sr_jxMNlDhkUA8zXj4X3NE0.exe"
    3⤵
    PID:19908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1320
      4⤵
      Kills process with taskkill
      PID:20352
- C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
  "C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    - Executes dropped EXE
    PID:4452
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    - Executes dropped EXE
    PID:4596
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4356
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4812
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5288
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5688
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4708
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6084
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4796
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:3000
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5144
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4448
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6164
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7076
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4180
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:572
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:3352
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:2224
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6904
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7396
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7740
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:3964
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4676
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5108
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7460
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5148
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:8440
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:8772
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9168
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:8600
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9068
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:8464
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9332
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9612
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10036
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9412
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9756
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7212
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10044
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9768
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10348
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10728
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11084
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10572
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11072
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10332
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10320 -s 24
      4⤵
      Program crash
      PID:11288
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9204
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11492
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11964
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:7520
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:9980
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:12052
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11372
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11420
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10436
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6824
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:12704
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13028
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10620
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10540
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13244 -s 24
      4⤵
      Program crash
      PID:684
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:3680
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13060
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13056
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13672
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:14020
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13376
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13460
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:14312
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:12208
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13052
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6244
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:14464
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:14880
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13540
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13224
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:1304
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:15260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15260 -s 24
      4⤵
      Program crash
      PID:9848
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:4780
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:15752
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:16312
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:15832
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:15048
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:13784
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:16672
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:17100
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 17100 -s 24
      4⤵
      Program crash
      PID:16472
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:16512
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:16584
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11436
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:17020
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:17772
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18216
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:17700
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18396
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18284
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:1524
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:5680
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18836
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:19256
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18792
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:18680
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:19148
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:19540
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:20044
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:20396
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:20860
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:21276
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:20676
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:21436
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:20816
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:21516
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:22068
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:22508
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:22132
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:1832
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:21844
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:22732
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:23116
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:19344
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:23216
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:23488
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:15640
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:6564
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:10228
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:24088
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:21392
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:24340
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:17672
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:23732
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:24688
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:25188
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:19868
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11680
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:11008
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:12976
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:24876
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:12548
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:25128
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:16136
- - C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    C:\Users\Admin\Documents\XvZ_nJwqtLMTVnoy7_EjCsvw.exe
    3⤵
    PID:25684
- C:\Users\Admin\Documents\OIo_Bc_T9wEx0pRpcoenbn9B.exe
  "C:\Users\Admin\Documents\OIo_Bc_T9wEx0pRpcoenbn9B.exe"
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 384
    3⤵
    - Program crash
    PID:5484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 372
    3⤵
    - Program crash
    PID:5804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 400
    3⤵
    - Program crash
    PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 620
    3⤵
    - Program crash
    PID:6136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 636
    3⤵
    - Program crash
    PID:6892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 588
    3⤵
    - Program crash
    PID:7456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 696
    3⤵
    - Program crash
    PID:7448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 708
    3⤵
    - Program crash
    PID:5424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 772
    3⤵
    - Program crash
    PID:15216
- C:\Users\Admin\Documents\lmaMvVLSlldscTHfY_MsKlQI.exe
  "C:\Users\Admin\Documents\lmaMvVLSlldscTHfY_MsKlQI.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2140
- C:\Users\Admin\Documents\I0NifhcTNXS6PieWMjjcoYX1.exe
  "C:\Users\Admin\Documents\I0NifhcTNXS6PieWMjjcoYX1.exe"
  2⤵
  - Executes dropped EXE
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 1588
    3⤵
    - Program crash
    PID:9544
- C:\Users\Admin\Documents\Q_RH4JYun9lNDl1rxQohw8jh.exe
  "C:\Users\Admin\Documents\Q_RH4JYun9lNDl1rxQohw8jh.exe"
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\05004839561.exe"
    3⤵
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\05004839561.exe
      "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\05004839561.exe"
      4⤵
      PID:12464
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\76277709536.exe" /mix
    3⤵
    PID:18148
  - - C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\76277709536.exe
      "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\76277709536.exe" /mix
      4⤵
      PID:15252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\71920627906.exe" /mix
    3⤵
    PID:20408
  - - C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\71920627906.exe
      "C:\Users\Admin\AppData\Local\Temp\{okrM-JhBDP-CsCG-3krt1}\71920627906.exe" /mix
      4⤵
      PID:20584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "Q_RH4JYun9lNDl1rxQohw8jh.exe" /f & erase "C:\Users\Admin\Documents\Q_RH4JYun9lNDl1rxQohw8jh.exe" & exit
    3⤵
    PID:17424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "Q_RH4JYun9lNDl1rxQohw8jh.exe" /f
      4⤵
      Kills process with taskkill
      PID:18400
- C:\Users\Admin\Documents\NmGWdfwemX_ARnRJ_GpZjlSu.exe
  "C:\Users\Admin\Documents\NmGWdfwemX_ARnRJ_GpZjlSu.exe"
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Users\Admin\Documents\NmGWdfwemX_ARnRJ_GpZjlSu.exe
    "C:\Users\Admin\Documents\NmGWdfwemX_ARnRJ_GpZjlSu.exe" -u
    3⤵
    PID:5604
- C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
  "C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    - Executes dropped EXE
    PID:4444
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    - Executes dropped EXE
    PID:4532
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5096
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5364
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5812
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:2056
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4912
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5136
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 24
      4⤵
      Program crash
      PID:5884
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4248
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5576
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5648
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:6236
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:6792
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:6200
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4232
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4772
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:2152
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5252
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7292
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7592
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7948
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7320
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:1660
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7224
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5352
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7628
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:7612
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8608
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8932
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8480
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:1532
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8968
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:9472
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:9848
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4144
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5040
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:9276
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:5908
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:9852
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:4132
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10596
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11064
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10276 -s 24
      4⤵
      Program crash
      PID:11192
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:8120
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10628
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11176
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11464
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11896
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12228
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12104
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11308
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:9620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9620 -s 24
      4⤵
      Program crash
      PID:11472
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10016
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:1968
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12448
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12872
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13228
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10264
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10844
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12216
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:1344
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:11904
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13496 -s 24
      4⤵
      Program crash
      PID:13868
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13844
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14264
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12092
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13952
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13744
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12580
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:13868
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14512
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14908
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14412
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:15100
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14628
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14664
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:15472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15472 -s 24
      4⤵
      Program crash
      PID:16032
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:15936
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:916
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:16148
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:15812
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:16404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16404 -s 24
      4⤵
      Program crash
      PID:16864
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:16876
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17280
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17156
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 17260 -s 24
      4⤵
      Program crash
      PID:16944
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14380
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17652
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18072
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17616
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18264
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17652
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18232
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:14688
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18808
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:19216
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18596
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17044
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:18316
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:19588
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:20096
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:19664
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:20948
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:21364
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:20800
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:17508
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:19672
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:21632
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22236
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:21592
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22092
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:3780
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:16592
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22932
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:23420
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22904
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22816
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:23468
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10228
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:16732
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24036
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24556
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24272
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:23792
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:23764
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24716
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:25260
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:23348
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10248
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:12980
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:10104
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:22712
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:15544
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24820
- - C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    C:\Users\Admin\Documents\vhZFt8Sl9dkK_FgxXXuySsrT.exe
    3⤵
    PID:24992
- C:\Users\Admin\Documents\n_mNEgTHD8Yp2G5j9NpSOQ01.exe
  "C:\Users\Admin\Documents\n_mNEgTHD8Yp2G5j9NpSOQ01.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2356
- C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
  "C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    - Executes dropped EXE
    PID:4476
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:4204
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5416
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:2336
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5824
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:4976
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:4936
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    - Executes dropped EXE
    PID:4664
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5808
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5436
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:4588
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6184
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6772
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:7164
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6644
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6256
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6864
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:3484
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:152
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:7420
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:7724
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8004
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:3940
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:7424
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8152 -s 24
      4⤵
      Program crash
      PID:7812
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:4716
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:7608
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6068
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8468
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8804
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5424
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8704
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6748
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8852
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:9456
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:9808
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:6404
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:9600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9600 -s 24
      4⤵
      Program crash
      PID:7924
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8332
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:1696
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:9176
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8028
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10624
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10960
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10332
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10808
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:9052
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8452
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:8800
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11348
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11660
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12108
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11548
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12176
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12256
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12256 -s 24
      4⤵
      Program crash
      PID:12048
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12104
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11272
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11756
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12632
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13016
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10680
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11152
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12784
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13156
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11112
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:892
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13532 -s 24
      4⤵
      Program crash
      PID:13900
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13836
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:14216
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12260
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11952
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10980
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13988
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12816
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10804
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:14696
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15212
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11540
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15076
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:14656
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:14780
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:10784
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15844
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:16360
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:16040
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15872
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:16208
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:16704
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:17132
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:16756
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13784
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13828
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:17480
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:17872
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18336
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15064
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18108
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:17476
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5008
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18444
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18852
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:19296
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18896
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:15792
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:19280
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:19576
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:20072
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:20280
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:20784
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21196
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:19940
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21312
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:20944
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21004
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21996
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:22468
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21840
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:13084
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:22360
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:22704
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:23028
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:23536
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:22884
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:18392
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:19172
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21048
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:23564
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:24112
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12364
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21616
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21428
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21820
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:24316
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:25044
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:25472
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:12724
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:24476
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:22064
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:21792
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:25408
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:11536
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:5324
- - C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    C:\Users\Admin\Documents\1WGzN9TtxnzdPO42fA4_Zir7.exe
    3⤵
    PID:24684
- C:\Users\Admin\Documents\9nPwBJD8RQr7siP8XyLznMW8.exe
  "C:\Users\Admin\Documents\9nPwBJD8RQr7siP8XyLznMW8.exe"
  2⤵
  - Executes dropped EXE
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 660
    3⤵
    - Program crash
    PID:4040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 700
    3⤵
    - Program crash
    PID:5540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 640
    3⤵
    - Program crash
    PID:5764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 720
    3⤵
    - Program crash
    PID:6068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 892
    3⤵
    - Program crash
    PID:5252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 1076
    3⤵
    - Program crash
    PID:6572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 692
    3⤵
    - Program crash
    PID:5316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 1240
    3⤵
    - Program crash
    PID:12576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 1388
    3⤵
    - Program crash
    PID:14124
- C:\Users\Admin\Documents\wKiZaxOjBTudfaMHdhXgKh7X.exe
  "C:\Users\Admin\Documents\wKiZaxOjBTudfaMHdhXgKh7X.exe"
  2⤵
  - Executes dropped EXE
  PID:2064
- - C:\Users\Admin\Documents\wKiZaxOjBTudfaMHdhXgKh7X.exe
    "C:\Users\Admin\Documents\wKiZaxOjBTudfaMHdhXgKh7X.exe"
    3⤵
    PID:2180
- C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe
  "C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe"
  2⤵
  - Executes dropped EXE
  PID:1640
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
    3⤵
    PID:5344
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\JT7JRqKTRwato5g6WYjnRRoy.exe" ) do taskkill /iM "%~NXm" -F
      4⤵
      PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
        
        IQ0v_FE_.ExE -poRsuYEMryiLi
        5⤵
        
        PID:9660
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
        6⤵
        
        PID:15396
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "JT7JRqKTRwato5g6WYjnRRoy.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:9240
- C:\Users\Admin\Documents\F0PXuqYCMYYNMichy4DjFNSL.exe
  "C:\Users\Admin\Documents\F0PXuqYCMYYNMichy4DjFNSL.exe"
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Users\Admin\Documents\9cIJOm9TPIteXMa14g3b7H0I.exe
  "C:\Users\Admin\Documents\9cIJOm9TPIteXMa14g3b7H0I.exe"
  2⤵
  - Executes dropped EXE
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"
    3⤵
    PID:5216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 264
      4⤵
      Program crash
      PID:9588
- C:\Users\Admin\Documents\ON3yzRggcKuFOsScMhmtU0p1.exe
  "C:\Users\Admin\Documents\ON3yzRggcKuFOsScMhmtU0p1.exe"
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4688
- C:\Users\Admin\Documents\hDjHfuz87XrxmsCjO5LWE0tT.exe
  "C:\Users\Admin\Documents\hDjHfuz87XrxmsCjO5LWE0tT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
  "C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    - Executes dropped EXE
    PID:4468
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4952
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4460
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4560
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    - Executes dropped EXE
    PID:2452
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5532
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5912
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4860
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    - Executes dropped EXE
    PID:4624
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4588
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5512
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5284
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:6208
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:6700
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7112
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:6804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6804 -s 24
      4⤵
      Program crash
      PID:5252
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4152
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5492
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:216
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7228
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7524
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7832
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8168
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5020
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7892
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:5784
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7960
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7900
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8072
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8516
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8872
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8236
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8988
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:8948
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:2544
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:9524
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:9924
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7024
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:6548
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 24
      4⤵
      Program crash
      PID:7720
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:7676
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:9968
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10284
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10668
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11040
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10412
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11132
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10888
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11176
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10544
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11440
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11932
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12264
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11848
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11292
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10212
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12144
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10032
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12380
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12820
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:13164
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12772
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10532
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10996
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:4808
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:3524
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:13456
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:13752
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:14076
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10708
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11340
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11732
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:13868
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11740
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11776
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:14584
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:14988
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:14388
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:12896
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:6128
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15224
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:1680
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15696
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:16188
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15484
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15444
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:10588
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:16552
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:17012
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:1508
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:17376
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15448
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:9804
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:17688
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18108
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:17648
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18296
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:15828
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18236
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:17576
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18736
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:19092
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18612
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:19404
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:1208
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18448
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:19856
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20332
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20660
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21088
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21492
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21068
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20976
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20988
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21916
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:22408
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21936
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:22384
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20268
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:22640
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23056
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:22172
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23212
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:19024
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23352
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:20516
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23580
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:24164
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23700
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:24304
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:19060
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:14664
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:24644
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:25164
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:25560
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:18576
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:24808
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:25568
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:22892
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:2104
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:23728
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:21152
- - C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    C:\Users\Admin\Documents\WTfTQcom6W_Fwcjh3iaMUoYK.exe
    3⤵
    PID:11416
- C:\Users\Admin\Documents\JkCeIwDI4mXFP_Mxahb3YBlG.exe
  "C:\Users\Admin\Documents\JkCeIwDI4mXFP_Mxahb3YBlG.exe"
  2⤵
  - Executes dropped EXE
  PID:4720
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    PID:6504
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    PID:6496
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    PID:6488
- C:\Users\Admin\Documents\mIIovUdayX9aLVsaQedTtn9P.exe
  "C:\Users\Admin\Documents\mIIovUdayX9aLVsaQedTtn9P.exe"
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Users\Admin\Documents\mIIovUdayX9aLVsaQedTtn9P.exe
    "C:\Users\Admin\Documents\mIIovUdayX9aLVsaQedTtn9P.exe"
    3⤵
    PID:5356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5356 -s 1492
      4⤵
      Program crash
      PID:19116
- C:\Users\Admin\Documents\YlLCPfgyo_ootxwtczwX7ByR.exe
  "C:\Users\Admin\Documents\YlLCPfgyo_ootxwtczwX7ByR.exe"
  2⤵
  PID:6032
- - C:\Users\Admin\AppData\Local\Temp\is-VK8KK.tmp\YlLCPfgyo_ootxwtczwX7ByR.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VK8KK.tmp\YlLCPfgyo_ootxwtczwX7ByR.tmp" /SL5="$40084,138429,56832,C:\Users\Admin\Documents\YlLCPfgyo_ootxwtczwX7ByR.exe"
    3⤵
    PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\is-FUEH9.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-FUEH9.tmp\Setup.exe" /Verysilent
      4⤵
      PID:16652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 24
1⤵
- Program crash
PID:4320

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:21104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-418-0x0000000000400000-0x00000000021B4000-memory.dmp

Filesize
29.7MB

Download
memory/748-398-0x0000000004240000-0x0000000004B66000-memory.dmp

Filesize
9.1MB

Download
memory/1320-256-0x0000000002843000-0x0000000002844000-memory.dmp

Filesize
4KB

Download
memory/1320-248-0x0000000002842000-0x0000000002843000-memory.dmp

Filesize
4KB

Download
memory/1320-236-0x0000000002840000-0x0000000002841000-memory.dmp

Filesize
4KB

Download
memory/1320-238-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/1320-290-0x0000000002844000-0x0000000002846000-memory.dmp

Filesize
8KB

Download
memory/1320-234-0x0000000004DC0000-0x0000000004E8F000-memory.dmp

Filesize
828KB

Download
memory/1320-261-0x0000000002980000-0x0000000002A4D000-memory.dmp

Filesize
820KB

Download
memory/1320-224-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/1320-221-0x00000000008E0000-0x000000000096E000-memory.dmp

Filesize
568KB

Download
memory/1480-199-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/1480-173-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/1696-114-0x0000000003640000-0x000000000377F000-memory.dmp

Filesize
1.2MB

Download
memory/2004-215-0x00000000006F0000-0x000000000083A000-memory.dmp

Filesize
1.3MB

Download
memory/2004-231-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2064-315-0x00000000022B0000-0x00000000022BA000-memory.dmp

Filesize
40KB

Download
memory/2140-209-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/2140-190-0x0000000077120000-0x00000000772AE000-memory.dmp

Filesize
1.6MB

Download
memory/2140-207-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/2140-200-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/2140-210-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/2140-213-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/2164-182-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/2164-172-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/2164-186-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/2164-191-0x00000000056D0000-0x0000000005746000-memory.dmp

Filesize
472KB

Download
memory/2168-339-0x0000000000400000-0x0000000001D81000-memory.dmp

Filesize
25.5MB

Download
memory/2168-335-0x0000000003960000-0x000000000398F000-memory.dmp

Filesize
188KB

Download
memory/2180-332-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2336-449-0x0000000005580000-0x0000000005A7E000-memory.dmp

Filesize
5.0MB

Download
memory/2356-211-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/2356-193-0x0000000077120000-0x00000000772AE000-memory.dmp

Filesize
1.6MB

Download
memory/2356-198-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/2356-205-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/2356-203-0x0000000005D30000-0x0000000005D31000-memory.dmp

Filesize
4KB

Download
memory/2452-450-0x00000000050D0000-0x00000000056D6000-memory.dmp

Filesize
6.0MB

Download
memory/2492-401-0x00000000014D0000-0x00000000014E6000-memory.dmp

Filesize
88KB

Download
memory/2724-178-0x000000001BE80000-0x000000001BE82000-memory.dmp

Filesize
8KB

Download
memory/2724-163-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2724-176-0x00000000016D0000-0x00000000016E8000-memory.dmp

Filesize
96KB

Download
memory/2808-195-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2808-180-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/3000-580-0x0000000005560000-0x0000000005B66000-memory.dmp

Filesize
6.0MB

Download
memory/3976-197-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/3976-177-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/4012-327-0x0000000003D80000-0x0000000003DAF000-memory.dmp

Filesize
188KB

Download
memory/4012-371-0x0000000000400000-0x000000000216E000-memory.dmp

Filesize
29.4MB

Download
memory/4204-379-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/4248-588-0x0000000005700000-0x0000000005D06000-memory.dmp

Filesize
6.0MB

Download
memory/4452-296-0x00000000051D0000-0x00000000057D6000-memory.dmp

Filesize
6.0MB

Download
memory/4452-216-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4460-375-0x0000000004D00000-0x0000000005306000-memory.dmp

Filesize
6.0MB

Download
memory/4468-219-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4468-282-0x0000000005280000-0x0000000005886000-memory.dmp

Filesize
6.0MB

Download
memory/4476-252-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/4476-298-0x00000000055C0000-0x0000000005ABE000-memory.dmp

Filesize
5.0MB

Download
memory/4476-218-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4532-304-0x0000000005140000-0x0000000005746000-memory.dmp

Filesize
6.0MB

Download
memory/4532-249-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4560-412-0x00000000054D0000-0x0000000005AD6000-memory.dmp

Filesize
6.0MB

Download
memory/4624-310-0x0000000004CB0000-0x00000000052B6000-memory.dmp

Filesize
6.0MB

Download
memory/4664-321-0x00000000052C0000-0x00000000057BE000-memory.dmp

Filesize
5.0MB

Download
memory/4708-437-0x0000000004CC0000-0x00000000052C6000-memory.dmp

Filesize
6.0MB

Download
memory/4748-355-0x0000000004F70000-0x000000000546E000-memory.dmp

Filesize
5.0MB

Download
memory/4796-351-0x0000000004C40000-0x0000000005246000-memory.dmp

Filesize
6.0MB

Download
memory/4860-560-0x0000000004E70000-0x0000000005476000-memory.dmp

Filesize
6.0MB

Download
memory/4952-343-0x0000000004F60000-0x0000000005566000-memory.dmp

Filesize
6.0MB

Download
memory/4976-415-0x0000000005390000-0x000000000588E000-memory.dmp

Filesize
5.0MB

Download
memory/5096-384-0x0000000005520000-0x0000000005B26000-memory.dmp

Filesize
6.0MB

Download
memory/5144-624-0x0000000004D30000-0x0000000005336000-memory.dmp

Filesize
6.0MB

Download
memory/5244-561-0x0000000005800000-0x0000000005CFE000-memory.dmp

Filesize
5.0MB

Download
memory/5284-680-0x0000000004E70000-0x0000000005476000-memory.dmp

Filesize
6.0MB

Download
memory/5364-474-0x00000000055D0000-0x0000000005BD6000-memory.dmp

Filesize
6.0MB

Download
memory/5416-484-0x0000000005680000-0x0000000005B7E000-memory.dmp

Filesize
5.0MB

Download
memory/5436-628-0x00000000055B0000-0x0000000005AAE000-memory.dmp

Filesize
5.0MB

Download
memory/5512-646-0x00000000054B0000-0x0000000005AB6000-memory.dmp

Filesize
6.0MB

Download
memory/5532-487-0x0000000004EE0000-0x00000000054E6000-memory.dmp

Filesize
6.0MB

Download
memory/5576-630-0x0000000005430000-0x0000000005A36000-memory.dmp

Filesize
6.0MB

Download
memory/5648-677-0x00000000050B0000-0x00000000056B6000-memory.dmp

Filesize
6.0MB

Download
memory/5688-508-0x00000000056A0000-0x0000000005CA6000-memory.dmp

Filesize
6.0MB

Download
memory/5808-590-0x0000000004EB0000-0x00000000053AE000-memory.dmp

Filesize
5.0MB

Download
memory/5812-522-0x0000000004F80000-0x0000000005586000-memory.dmp

Filesize
6.0MB

Download
memory/5824-523-0x0000000004F50000-0x000000000544E000-memory.dmp

Filesize
5.0MB

Download
memory/5912-526-0x0000000004E60000-0x0000000005466000-memory.dmp

Filesize
6.0MB

Download
memory/6032-639-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6084-552-0x0000000005000000-0x0000000005606000-memory.dmp

Filesize
6.0MB

Download