redline | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (22).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

redline vidar 1 norman2 spnewportspectr discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

37.0.8.88:44263

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Extracted

Family

redline

Botnet

spnewportspectr

135.148.139.222:1594

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 44 IoCs

resource	yara_rule
behavioral30/memory/4472-280-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/4392-295-0x0000000004F30000-0x0000000005536000-memory.dmp	family_redline
behavioral30/memory/4636-333-0x0000000004FB0000-0x00000000055B6000-memory.dmp	family_redline
behavioral30/memory/4768-315-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4636-303-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4472-274-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral30/memory/4428-268-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/5020-342-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/5088-354-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4400-380-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4548-389-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/4556-392-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4988-418-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4556-432-0x00000000055D0000-0x0000000005BD6000-memory.dmp	family_redline
behavioral30/memory/4332-452-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/3772-461-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/4836-450-0x0000000005840000-0x0000000005E46000-memory.dmp	family_redline
behavioral30/memory/5164-511-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5192-515-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4120-510-0x0000000004E40000-0x0000000005446000-memory.dmp	family_redline
behavioral30/memory/5136-506-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/5420-540-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/5480-545-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/1776-486-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4576-479-0x00000000056B0000-0x0000000005CB6000-memory.dmp	family_redline
behavioral30/memory/4120-478-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/5540-552-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4576-444-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5668-569-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/744-428-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/5784-583-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/4836-408-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5888-593-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5900-592-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/6036-618-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/2176-638-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/6128-629-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/5680-652-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4260-369-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5976-666-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5072-352-0x000000000041C6A6-mapping.dmp	family_redline
behavioral30/memory/4428-263-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral30/memory/4392-252-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4392-247-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral30/memory/4472-314-0x00000000051C0000-0x00000000057C6000-memory.dmp	family_vidar
behavioral30/memory/1124-318-0x0000000000400000-0x0000000000593000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 53 IoCs

pid	Process
2172	qldXP_LVva6m5xarh85SIt4j.exe
3392	DAKyeskWKjej8sr7qnNWC6rG.exe
3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe
3212	0_LxLEAOl0eEUP3oeI2w95PM.exe
3536	P1v2T0N83Fm3pd0zi0tVssDT.exe
612	Zaxfuja2TgYc0k4w1DRPMz97.exe
576	yRL_lgNHoXtioxcp_D1TsntN.exe
1124	6cgGBnwKujFig7Z5Sxbt6YEE.exe
2284	lQwuDRdRWeTAC_M4xi5l3EHd.exe
3304	BYrgOAZttlg8AcBOnBsqGoF5.exe
1408	raXVDati9eY2Hx3VFTWqEKOb.exe
3612	Gbfi7LzvQLsyKBBwrA8GeOWW.exe
740	bXEOtZe3bw1E1sRpa_l7sZVy.exe
1212	UhhQQIxuLQj0HFPR5UV4Bkb0.exe
3688	wyjCDsxfB9oQwDrcYxH3maK0.exe
3988	3iDog9bVoU6LnujCExNLtTGB.exe
788	6Pq1bV53gkmINAYMZYG0CW2O.exe
920	PN3_Gk4ipCw5xUlSaDwgh0eN.exe
1100	JPDtV6kJekFzvyLOrKjwhiEl.exe
2000	aAXrZxntTL0moQYwsMdgDYL2.exe
3592	tULt7zqR32efFcNbrRnsR8HB.exe
416	AxuAPGH_6N6efewS37rnnRVJ.exe
4176	JPDtV6kJekFzvyLOrKjwhiEl.tmp
4392	twXtK_rf2ZPI2ed6AZzUqNoy.exe
4572	Gbfi7LzvQLsyKBBwrA8GeOWW.exe
4608	cutm3.exe
4668	md8_8eus.exe
4428	DAKyeskWKjej8sr7qnNWC6rG.exe
4472	raXVDati9eY2Hx3VFTWqEKOb.exe
4516	wyjCDsxfB9oQwDrcYxH3maK0.exe
4636	twXtK_rf2ZPI2ed6AZzUqNoy.exe
4768	DAKyeskWKjej8sr7qnNWC6rG.exe
4828	wyjCDsxfB9oQwDrcYxH3maK0.exe
4872	raXVDati9eY2Hx3VFTWqEKOb.exe
5020	twXtK_rf2ZPI2ed6AZzUqNoy.exe
5072	wyjCDsxfB9oQwDrcYxH3maK0.exe
5088	DAKyeskWKjej8sr7qnNWC6rG.exe
4260	raXVDati9eY2Hx3VFTWqEKOb.exe
4400	twXtK_rf2ZPI2ed6AZzUqNoy.exe
4548	wyjCDsxfB9oQwDrcYxH3maK0.exe
4556	DAKyeskWKjej8sr7qnNWC6rG.exe
4836	raXVDati9eY2Hx3VFTWqEKOb.exe
4988	twXtK_rf2ZPI2ed6AZzUqNoy.exe
5112	raXVDati9eY2Hx3VFTWqEKOb.exe
744	wyjCDsxfB9oQwDrcYxH3maK0.exe
4576	raXVDati9eY2Hx3VFTWqEKOb.exe
4856	DAKyeskWKjej8sr7qnNWC6rG.exe
4332	twXtK_rf2ZPI2ed6AZzUqNoy.exe
3772	wyjCDsxfB9oQwDrcYxH3maK0.exe
4120	DAKyeskWKjej8sr7qnNWC6rG.exe
3780	raXVDati9eY2Hx3VFTWqEKOb.exe
1776	twXtK_rf2ZPI2ed6AZzUqNoy.exe
4832	wyjCDsxfB9oQwDrcYxH3maK0.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lQwuDRdRWeTAC_M4xi5l3EHd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lQwuDRdRWeTAC_M4xi5l3EHd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3iDog9bVoU6LnujCExNLtTGB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3iDog9bVoU6LnujCExNLtTGB.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup (22).exe

Loads dropped DLL 2 IoCs

pid	Process
4176	JPDtV6kJekFzvyLOrKjwhiEl.tmp
4176	JPDtV6kJekFzvyLOrKjwhiEl.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral30/files/0x000100000001ab8a-139.dat	themida
behavioral30/files/0x000100000001ab8a-154.dat	themida
behavioral30/files/0x000100000001ab7a-171.dat	themida
behavioral30/files/0x000100000001ab7a-203.dat	themida
behavioral30/memory/2284-231-0x0000000000FC0000-0x0000000000FC1000-memory.dmp	themida
behavioral30/memory/3988-235-0x0000000001040000-0x0000000001041000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lQwuDRdRWeTAC_M4xi5l3EHd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3iDog9bVoU6LnujCExNLtTGB.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ipinfo.io
30	ipinfo.io
34	api.db-ip.com
119	ipinfo.io
151	ipinfo.io
33	api.db-ip.com
118	ipinfo.io
120	ip-api.com
585	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2284	lQwuDRdRWeTAC_M4xi5l3EHd.exe
3988	3iDog9bVoU6LnujCExNLtTGB.exe

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 3900 set thread context of 4392	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	213
PID 3392 set thread context of 4428	3392	DAKyeskWKjej8sr7qnNWC6rG.exe	212
PID 1408 set thread context of 4472	1408	raXVDati9eY2Hx3VFTWqEKOb.exe	211
PID 3900 set thread context of 4636	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	209
PID 3392 set thread context of 4768	3392	DAKyeskWKjej8sr7qnNWC6rG.exe	111
PID 3900 set thread context of 5020	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	115
PID 3688 set thread context of 5072	3688	wyjCDsxfB9oQwDrcYxH3maK0.exe	114
PID 3392 set thread context of 5088	3392	DAKyeskWKjej8sr7qnNWC6rG.exe	112
PID 1408 set thread context of 4260	1408	raXVDati9eY2Hx3VFTWqEKOb.exe	113
PID 3900 set thread context of 4400	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	118
PID 3688 set thread context of 4548	3688	wyjCDsxfB9oQwDrcYxH3maK0.exe	159
PID 3392 set thread context of 4556	3392	DAKyeskWKjej8sr7qnNWC6rG.exe	119
PID 1408 set thread context of 4836	1408	raXVDati9eY2Hx3VFTWqEKOb.exe	121
PID 3900 set thread context of 4988	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	122
PID 3688 set thread context of 744	3688	wyjCDsxfB9oQwDrcYxH3maK0.exe	123
PID 1408 set thread context of 4576	1408	raXVDati9eY2Hx3VFTWqEKOb.exe	149
PID 3900 set thread context of 4332	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	124
PID 3688 set thread context of 3772	3688	wyjCDsxfB9oQwDrcYxH3maK0.exe	125
PID 3392 set thread context of 4120	3392	DAKyeskWKjej8sr7qnNWC6rG.exe	126
PID 3900 set thread context of 1776	3900	twXtK_rf2ZPI2ed6AZzUqNoy.exe	127
PID 3612 set thread context of 4572	3612	Gbfi7LzvQLsyKBBwrA8GeOWW.exe	141

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\DotNetZip-up24mtgz.tmp	0_LxLEAOl0eEUP3oeI2w95PM.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	BYrgOAZttlg8AcBOnBsqGoF5.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	BYrgOAZttlg8AcBOnBsqGoF5.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	BYrgOAZttlg8AcBOnBsqGoF5.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	BYrgOAZttlg8AcBOnBsqGoF5.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	BYrgOAZttlg8AcBOnBsqGoF5.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	raXVDati9eY2Hx3VFTWqEKOb.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	raXVDati9eY2Hx3VFTWqEKOb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 33 IoCs

pid	pid_target	Process	procid_target
5760	788	WerFault.exe	97
5780	576	WerFault.exe	84
5804	576	WerFault.exe	84
2292	788	WerFault.exe	97
4756	788	WerFault.exe	97
200	576	WerFault.exe	84
6816	788	WerFault.exe	97
6712	7128	WerFault.exe	191
6428	6612	WerFault.exe	197
4916	576	WerFault.exe	84
5828	788	WerFault.exe	97
5328	576	WerFault.exe	84
8856	576	WerFault.exe	84
860	9108	WerFault.exe	258
8648	788	WerFault.exe	97
1028	8572	WerFault.exe	278
9112	788	WerFault.exe	97
9620	9072	WerFault.exe	284
9688	9344	WerFault.exe	286
9740	7668	WerFault.exe	314
1712	576	WerFault.exe	84
2972	4688	WerFault.exe	164
4196	576	WerFault.exe	84
12816	1124	WerFault.exe	87
12384	13804	WerFault.exe	441
13952	13348	WerFault.exe	452
13016	6364	WerFault.exe	179
9708	15152	WerFault.exe	476
1712	788	WerFault.exe	97
16916	16188	WerFault.exe	514
16756	576	WerFault.exe	84
16840	788	WerFault.exe	97
16680	788	WerFault.exe	97

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4500	schtasks.exe
4496	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
13632	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	149	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	174	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	586	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
856	Setup (22).exe
856	Setup (22).exe
3212	0_LxLEAOl0eEUP3oeI2w95PM.exe
3212	0_LxLEAOl0eEUP3oeI2w95PM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	P1v2T0N83Fm3pd0zi0tVssDT.exe
Token: SeDebugPrivilege	416	AxuAPGH_6N6efewS37rnnRVJ.exe
Token: SeDebugPrivilege	3212	0_LxLEAOl0eEUP3oeI2w95PM.exe
Token: SeDebugPrivilege	4428	DAKyeskWKjej8sr7qnNWC6rG.exe
Token: SeDebugPrivilege	3988	3iDog9bVoU6LnujCExNLtTGB.exe
Token: SeDebugPrivilege	2284	lQwuDRdRWeTAC_M4xi5l3EHd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4176	JPDtV6kJekFzvyLOrKjwhiEl.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3392	856	Setup (22).exe	78
PID 856 wrote to memory of 3392	856	Setup (22).exe	78
PID 856 wrote to memory of 3392	856	Setup (22).exe	78
PID 856 wrote to memory of 2172	856	Setup (22).exe	79
PID 856 wrote to memory of 2172	856	Setup (22).exe	79
PID 856 wrote to memory of 2172	856	Setup (22).exe	79
PID 856 wrote to memory of 3900	856	Setup (22).exe	80
PID 856 wrote to memory of 3900	856	Setup (22).exe	80
PID 856 wrote to memory of 3900	856	Setup (22).exe	80
PID 856 wrote to memory of 3536	856	Setup (22).exe	83
PID 856 wrote to memory of 3536	856	Setup (22).exe	83
PID 856 wrote to memory of 3212	856	Setup (22).exe	89
PID 856 wrote to memory of 3212	856	Setup (22).exe	89
PID 856 wrote to memory of 3212	856	Setup (22).exe	89
PID 856 wrote to memory of 576	856	Setup (22).exe	84
PID 856 wrote to memory of 576	856	Setup (22).exe	84
PID 856 wrote to memory of 576	856	Setup (22).exe	84
PID 856 wrote to memory of 3304	856	Setup (22).exe	88
PID 856 wrote to memory of 3304	856	Setup (22).exe	88
PID 856 wrote to memory of 3304	856	Setup (22).exe	88
PID 856 wrote to memory of 2284	856	Setup (22).exe	85
PID 856 wrote to memory of 2284	856	Setup (22).exe	85
PID 856 wrote to memory of 2284	856	Setup (22).exe	85
PID 856 wrote to memory of 612	856	Setup (22).exe	86
PID 856 wrote to memory of 612	856	Setup (22).exe	86
PID 856 wrote to memory of 612	856	Setup (22).exe	86
PID 856 wrote to memory of 1124	856	Setup (22).exe	87
PID 856 wrote to memory of 1124	856	Setup (22).exe	87
PID 856 wrote to memory of 1124	856	Setup (22).exe	87
PID 856 wrote to memory of 1408	856	Setup (22).exe	93
PID 856 wrote to memory of 1408	856	Setup (22).exe	93
PID 856 wrote to memory of 1408	856	Setup (22).exe	93
PID 856 wrote to memory of 3612	856	Setup (22).exe	92
PID 856 wrote to memory of 3612	856	Setup (22).exe	92
PID 856 wrote to memory of 3612	856	Setup (22).exe	92
PID 856 wrote to memory of 740	856	Setup (22).exe	96
PID 856 wrote to memory of 740	856	Setup (22).exe	96
PID 856 wrote to memory of 740	856	Setup (22).exe	96
PID 856 wrote to memory of 1212	856	Setup (22).exe	95
PID 856 wrote to memory of 1212	856	Setup (22).exe	95
PID 856 wrote to memory of 1212	856	Setup (22).exe	95
PID 856 wrote to memory of 3688	856	Setup (22).exe	94
PID 856 wrote to memory of 3688	856	Setup (22).exe	94
PID 856 wrote to memory of 3688	856	Setup (22).exe	94
PID 856 wrote to memory of 3988	856	Setup (22).exe	99
PID 856 wrote to memory of 3988	856	Setup (22).exe	99
PID 856 wrote to memory of 3988	856	Setup (22).exe	99
PID 856 wrote to memory of 788	856	Setup (22).exe	97
PID 856 wrote to memory of 788	856	Setup (22).exe	97
PID 856 wrote to memory of 788	856	Setup (22).exe	97
PID 856 wrote to memory of 920	856	Setup (22).exe	101
PID 856 wrote to memory of 920	856	Setup (22).exe	101
PID 856 wrote to memory of 1100	856	Setup (22).exe	103
PID 856 wrote to memory of 1100	856	Setup (22).exe	103
PID 856 wrote to memory of 1100	856	Setup (22).exe	103
PID 856 wrote to memory of 2000	856	Setup (22).exe	102
PID 856 wrote to memory of 2000	856	Setup (22).exe	102
PID 856 wrote to memory of 2000	856	Setup (22).exe	102
PID 856 wrote to memory of 3592	856	Setup (22).exe	105
PID 856 wrote to memory of 3592	856	Setup (22).exe	105
PID 856 wrote to memory of 3592	856	Setup (22).exe	105
PID 856 wrote to memory of 416	856	Setup (22).exe	106
PID 856 wrote to memory of 416	856	Setup (22).exe	106
PID 1100 wrote to memory of 4176	1100	JPDtV6kJekFzvyLOrKjwhiEl.exe	107

C:\Users\Admin\AppData\Local\Temp\Setup (22).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (22).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
  "C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3392
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    PID:5088
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    PID:4556
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    PID:4120
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5344
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5668
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:4312
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6036
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    PID:4856
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5112
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5680
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5052
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5520
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5436
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6232
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6660
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7068
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7016
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:5796
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:4164
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6172
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6816
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7472
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7952
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7400
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8028
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8004
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7352
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8372
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8728
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8316
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8900
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8572 -s 24
      4⤵
      Program crash
      PID:1028
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8656
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9456
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9696
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9968
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8764
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6412
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9896
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7508
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9156
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7844
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:3676
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:3840
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:1864
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7736
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8276
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:10396
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:10776
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11124
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:10800
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:8220
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:10672
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11484
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12056
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11544
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12160
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12244
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11276
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12380
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12780
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13232
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:12640
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13044
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:3936
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11008
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:9980
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13668
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14204
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13480
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13348 -s 24
      4⤵
      Program crash
      PID:13952
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:11492
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13828
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14432
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14800
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:15172
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14588
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:10016
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14596
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:14532
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:15800
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16164
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16176
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16392
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16872
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17320
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16532
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16832
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17140
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17540
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17944
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:18428
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17876
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16332
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17732
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:19084
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:18956
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:7764
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:2312
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6444
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:15704
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16804
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:19772
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:20136
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16988
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:20176
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16468
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:18180
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:18108
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:20572
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:20968
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21400
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:13764
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:20056
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21452
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:17784
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21956
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:22372
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21596
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:22504
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21096
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:6764
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:21824
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:16128
- - C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    C:\Users\Admin\Documents\DAKyeskWKjej8sr7qnNWC6rG.exe
    3⤵
    PID:22632
- C:\Users\Admin\Documents\qldXP_LVva6m5xarh85SIt4j.exe
  "C:\Users\Admin\Documents\qldXP_LVva6m5xarh85SIt4j.exe"
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4500
- C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
  "C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3900
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:5020
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:4400
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:4988
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:4332
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:1776
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5192
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5540
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5900
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:2176
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6060
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:3828
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:500
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5500
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6492
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6872
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6700
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:3632
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6172
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:4636
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    - Executes dropped EXE
    PID:4392
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:2840
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6260
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7244
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7660
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8068
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5452
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6032
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7968
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8212
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8632
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9108 -s 24
      4⤵
      Program crash
      PID:860
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8376
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8612
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8784
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9376
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9628
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9856
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10200
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9436
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8396
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8648
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9304
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9220
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9452
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10056
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:2228
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7292
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10048
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:2228
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6156
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10556
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10972
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5208
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:4108
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10868
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11268
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11848
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:5428
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9960
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6912
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6468
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6240
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:12592
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13040
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:12376
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13084
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:2104
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:12588
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11728
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13368
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13768
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14308
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13656
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:10540
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11300
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14128
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14392
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14816
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:15152
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15152 -s 24
      4⤵
      Program crash
      PID:9708
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:3200
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:15244
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14432
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:15412
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:15816
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:16216
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14536
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:16528
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:16976
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17404
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:3716
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14304
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17356
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17652
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:18048
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17508
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:18012
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17704
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:18016
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19208
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7492
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:9104
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:14540
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11716
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:11424
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:6784
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19916
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:13920
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19968
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19688
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20448
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:8108
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:17984
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20876
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:21236
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20568
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:21196
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20908
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19856
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:21732
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:22140
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:19044
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:21784
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:7668
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20692
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:20212
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:16248
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:18048
- - C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    C:\Users\Admin\Documents\twXtK_rf2ZPI2ed6AZzUqNoy.exe
    3⤵
    PID:22788
- C:\Users\Admin\Documents\P1v2T0N83Fm3pd0zi0tVssDT.exe
  "C:\Users\Admin\Documents\P1v2T0N83Fm3pd0zi0tVssDT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- - C:\Users\Admin\AppData\Roaming\2360818.exe
    "C:\Users\Admin\AppData\Roaming\2360818.exe"
    3⤵
    PID:8776
- - C:\Users\Admin\AppData\Roaming\5789748.exe
    "C:\Users\Admin\AppData\Roaming\5789748.exe"
    3⤵
    PID:8864
- - C:\Users\Admin\AppData\Roaming\6932515.exe
    "C:\Users\Admin\AppData\Roaming\6932515.exe"
    3⤵
    PID:8848
- - C:\Users\Admin\AppData\Roaming\5510190.exe
    "C:\Users\Admin\AppData\Roaming\5510190.exe"
    3⤵
    PID:8752
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:14072
- - C:\Users\Admin\AppData\Roaming\1789362.exe
    "C:\Users\Admin\AppData\Roaming\1789362.exe"
    3⤵
    PID:8708
- C:\Users\Admin\Documents\yRL_lgNHoXtioxcp_D1TsntN.exe
  "C:\Users\Admin\Documents\yRL_lgNHoXtioxcp_D1TsntN.exe"
  2⤵
  - Executes dropped EXE
  PID:576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 384
    3⤵
    - Program crash
    PID:5780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 364
    3⤵
    - Program crash
    PID:5804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 404
    3⤵
    - Program crash
    PID:200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 620
    3⤵
    - Program crash
    PID:4916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 636
    3⤵
    - Program crash
    PID:5328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 596
    3⤵
    - Program crash
    PID:8856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 688
    3⤵
    - Program crash
    PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 700
    3⤵
    - Program crash
    PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 780
    3⤵
    - Program crash
    PID:16756
- C:\Users\Admin\Documents\lQwuDRdRWeTAC_M4xi5l3EHd.exe
  "C:\Users\Admin\Documents\lQwuDRdRWeTAC_M4xi5l3EHd.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe
  "C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe"
  2⤵
  - Executes dropped EXE
  PID:612
- - C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe
    "C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe"
    3⤵
    PID:6336
- - C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe
    "C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe"
    3⤵
    PID:6364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6364 -s 1480
      4⤵
      Program crash
      PID:13016
- - C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe
    "C:\Users\Admin\Documents\Zaxfuja2TgYc0k4w1DRPMz97.exe"
    3⤵
    PID:6280
- C:\Users\Admin\Documents\6cgGBnwKujFig7Z5Sxbt6YEE.exe
  "C:\Users\Admin\Documents\6cgGBnwKujFig7Z5Sxbt6YEE.exe"
  2⤵
  - Executes dropped EXE
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1440
    3⤵
    - Program crash
    PID:12816
- C:\Users\Admin\Documents\BYrgOAZttlg8AcBOnBsqGoF5.exe
  "C:\Users\Admin\Documents\BYrgOAZttlg8AcBOnBsqGoF5.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3304
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    PID:4572
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4608
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:4668
- C:\Users\Admin\Documents\0_LxLEAOl0eEUP3oeI2w95PM.exe
  "C:\Users\Admin\Documents\0_LxLEAOl0eEUP3oeI2w95PM.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:8788
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:6432
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="6432.0.1544024655\2120233356" -parentBuildID 20200403170909 -prefsHandle 1460 -prefMapHandle 1452 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 6432 "\\.\pipe\gecko-crash-server-pipe.6432" 1540 gpu
        5⤵
        
        PID:15848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:10268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff91d934f50,0x7ff91d934f60,0x7ff91d934f70
      4⤵
      PID:14796
- C:\Users\Admin\Documents\Gbfi7LzvQLsyKBBwrA8GeOWW.exe
  "C:\Users\Admin\Documents\Gbfi7LzvQLsyKBBwrA8GeOWW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3612
- - C:\Users\Admin\Documents\Gbfi7LzvQLsyKBBwrA8GeOWW.exe
    "C:\Users\Admin\Documents\Gbfi7LzvQLsyKBBwrA8GeOWW.exe"
    3⤵
    - Executes dropped EXE
    PID:4572
- C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
  "C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1408
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:4260
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:4872
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:4836
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5480
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5888
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5164
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:3780
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:4312
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:4576
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5976
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6068
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:4312
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6196
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6688
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:7128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7128 -s 24
      4⤵
      Program crash
      PID:6712
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6584
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5356
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:4472
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6960
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6408
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:7304
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Drops file in Program Files directory
    PID:2172
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    - Executes dropped EXE
    PID:5112
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5416
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:8408
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:8872
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:8528
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:8308
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6520
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9344 -s 24
      4⤵
      Program crash
      PID:9688
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9656
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9952
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9240
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:612
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9888
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:7668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7668 -s 24
      4⤵
      Program crash
      PID:9740
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10084
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6500
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:2012
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:7456
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:4756
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10072
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:4196
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10344
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10740
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11160
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10944
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11096
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10728
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11752
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:12228
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11856
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11448
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11884
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:4684
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:12660
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13096
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:11580
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13240
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:12456
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13092
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13420
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13804 -s 24
      4⤵
      Program crash
      PID:12384
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13352
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13740
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:12384
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9368
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13472
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:14664
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:14964
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13436
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:14556
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5604
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:9576
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:15668
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:16080
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:15672
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:16188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 16188 -s 24
      4⤵
      Program crash
      PID:16916
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:16864
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:17360
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:16916
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5524
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10988
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:17628
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:18060
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:14416
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:17892
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:18132
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:18936
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:15296
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19316
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:10524
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5468
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:6276
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:15692
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19656
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:20064
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19672
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19712
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19952
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:5052
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19912
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:20544
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:20912
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:21308
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:20756
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:13940
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:21080
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:1848
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:22052
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:19404
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:22012
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:22472
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:21708
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:21828
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:22080
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:21360
- - C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    C:\Users\Admin\Documents\raXVDati9eY2Hx3VFTWqEKOb.exe
    3⤵
    PID:22760
- C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
  "C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3688
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:5072
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:4828
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:744
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:3772
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:4832
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5136
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5420
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5784
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6128
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5940
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:4548
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5956
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5352
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5308
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6524
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6892
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6256
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6612 -s 24
      4⤵
      Program crash
      PID:6428
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5968
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    - Executes dropped EXE
    PID:4516
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:1452
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:60
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7200
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7564
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8052
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7688
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7356
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5948
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8284
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8720
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8388
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8688
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9004
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9072 -s 24
      4⤵
      Program crash
      PID:9620
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9528
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9812
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10136
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6396
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9720
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6264
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6584
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9820
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:1140
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:3700
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:2412
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7584
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:7652
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9508
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10324
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10708
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11088
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:6560
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10516
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8672
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11344
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11968
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11392
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12068
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11632
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10612
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:9028
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12696
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13148
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12464
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10140
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10280
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12864
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13044
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13612
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:14108
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13576
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:14224
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13504
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11256
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13736
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:14776
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:15116
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10188
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12548
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:11196
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:12476
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:15680
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:16064
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:15960
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:15728
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:16760
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17172
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:13468
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:8616
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17144
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:4752
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17760
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:18172
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17588
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:18160
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17568
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:18904
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:19420
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:4356
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10472
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:16940
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:5828
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:4436
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:19536
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20108
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:10764
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20416
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:19620
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:19940
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:17576
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20732
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21104
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20408
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20736
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:20840
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21328
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21640
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:22152
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21532
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21948
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:21900
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:15708
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:22284
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:22236
- - C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    C:\Users\Admin\Documents\wyjCDsxfB9oQwDrcYxH3maK0.exe
    3⤵
    PID:22624
- C:\Users\Admin\Documents\UhhQQIxuLQj0HFPR5UV4Bkb0.exe
  "C:\Users\Admin\Documents\UhhQQIxuLQj0HFPR5UV4Bkb0.exe"
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\04738949755.exe"
    3⤵
    PID:15848
  - - C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\04738949755.exe
      "C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\04738949755.exe"
      4⤵
      PID:15800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\78927627469.exe" /mix
    3⤵
    PID:18284
  - - C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\78927627469.exe
      "C:\Users\Admin\AppData\Local\Temp\{IAcC-9pRWB-NYHY-M1jWm}\78927627469.exe" /mix
      4⤵
      PID:13520
- C:\Users\Admin\Documents\bXEOtZe3bw1E1sRpa_l7sZVy.exe
  "C:\Users\Admin\Documents\bXEOtZe3bw1E1sRpa_l7sZVy.exe"
  2⤵
  - Executes dropped EXE
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"
    3⤵
    PID:4688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 264
      4⤵
      Program crash
      PID:2972
- C:\Users\Admin\Documents\6Pq1bV53gkmINAYMZYG0CW2O.exe
  "C:\Users\Admin\Documents\6Pq1bV53gkmINAYMZYG0CW2O.exe"
  2⤵
  - Executes dropped EXE
  PID:788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 660
    3⤵
    - Program crash
    PID:5760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 664
    3⤵
    - Program crash
    PID:2292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 684
    3⤵
    - Program crash
    PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 628
    3⤵
    - Program crash
    PID:6816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 892
    3⤵
    - Program crash
    PID:5828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1040
    3⤵
    - Program crash
    PID:8648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1060
    3⤵
    - Program crash
    PID:9112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1212
    3⤵
    - Program crash
    PID:1712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 716
    3⤵
    - Program crash
    PID:16840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 1356
    3⤵
    - Program crash
    PID:16680
- C:\Users\Admin\Documents\3iDog9bVoU6LnujCExNLtTGB.exe
  "C:\Users\Admin\Documents\3iDog9bVoU6LnujCExNLtTGB.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Users\Admin\Documents\PN3_Gk4ipCw5xUlSaDwgh0eN.exe
  "C:\Users\Admin\Documents\PN3_Gk4ipCw5xUlSaDwgh0eN.exe"
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Users\Admin\Documents\aAXrZxntTL0moQYwsMdgDYL2.exe
  "C:\Users\Admin\Documents\aAXrZxntTL0moQYwsMdgDYL2.exe"
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Users\Admin\Documents\aAXrZxntTL0moQYwsMdgDYL2.exe
    "C:\Users\Admin\Documents\aAXrZxntTL0moQYwsMdgDYL2.exe" -u
    3⤵
    PID:6360
- C:\Users\Admin\Documents\JPDtV6kJekFzvyLOrKjwhiEl.exe
  "C:\Users\Admin\Documents\JPDtV6kJekFzvyLOrKjwhiEl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Users\Admin\AppData\Local\Temp\is-AN7CR.tmp\JPDtV6kJekFzvyLOrKjwhiEl.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-AN7CR.tmp\JPDtV6kJekFzvyLOrKjwhiEl.tmp" /SL5="$8007C,138429,56832,C:\Users\Admin\Documents\JPDtV6kJekFzvyLOrKjwhiEl.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\is-KFEOQ.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-KFEOQ.tmp\Setup.exe" /Verysilent
      4⤵
      PID:4524
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        5⤵
        
        PID:19332
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:6684
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17732
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15940
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19780
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20204
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19816
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17512
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15976
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17268
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19572
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20600
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21472
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11704
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8888
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20520
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21272
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21920
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22308
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20656
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22336
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21976
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:3908
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:7340
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:2652
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22676
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        5⤵
        
        PID:19388
      - C:\Users\Admin\AppData\Local\Temp\is-FFS9U.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FFS9U.tmp\stats.tmp" /SL5="$10884,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        6⤵
        
        PID:12680
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
        5⤵
        
        PID:19380
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
        5⤵
        
        PID:19372
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
        5⤵
        
        PID:19364
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
        5⤵
        
        PID:19352
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        5⤵
        
        PID:19344
- C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe
  "C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe"
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
    3⤵
    PID:6292
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\tULt7zqR32efFcNbrRnsR8HB.exe" ) do taskkill /iM "%~NXm" -F
      4⤵
      PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
        
        IQ0v_FE_.ExE -poRsuYEMryiLi
        5⤵
        
        PID:12788
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "tULt7zqR32efFcNbrRnsR8HB.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:13632
- C:\Users\Admin\Documents\AxuAPGH_6N6efewS37rnnRVJ.exe
  "C:\Users\Admin\Documents\AxuAPGH_6N6efewS37rnnRVJ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-206-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/416-225-0x00000000015B0000-0x00000000015C8000-memory.dmp

Filesize
96KB

Download
memory/416-228-0x000000001BC00000-0x000000001BC02000-memory.dmp

Filesize
8KB

Download
memory/612-201-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/612-193-0x0000000003380000-0x0000000003412000-memory.dmp

Filesize
584KB

Download
memory/612-224-0x0000000005DD0000-0x0000000005DE6000-memory.dmp

Filesize
88KB

Download
memory/612-167-0x0000000005970000-0x0000000005971000-memory.dmp

Filesize
4KB

Download
memory/612-146-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/612-161-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/612-226-0x0000000007710000-0x0000000007711000-memory.dmp

Filesize
4KB

Download
memory/744-471-0x0000000005760000-0x0000000005C5E000-memory.dmp

Filesize
5.0MB

Download
memory/856-114-0x00000000043C0000-0x00000000044FF000-memory.dmp

Filesize
1.2MB

Download
memory/1100-187-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1124-318-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1124-297-0x00000000005A0000-0x00000000006EA000-memory.dmp

Filesize
1.3MB

Download
memory/1408-221-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/1408-180-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1776-513-0x0000000004E70000-0x0000000005476000-memory.dmp

Filesize
6.0MB

Download
memory/2284-277-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/2284-253-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/2284-231-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/2284-239-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/2284-250-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/2284-241-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/2284-205-0x00000000777D0000-0x000000007795E000-memory.dmp

Filesize
1.6MB

Download
memory/2284-244-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/3212-310-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/3212-292-0x00000000006F0000-0x000000000083A000-memory.dmp

Filesize
1.3MB

Download
memory/3212-301-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/3212-323-0x0000000002994000-0x0000000002996000-memory.dmp

Filesize
8KB

Download
memory/3212-332-0x0000000002993000-0x0000000002994000-memory.dmp

Filesize
4KB

Download
memory/3212-327-0x0000000002992000-0x0000000002993000-memory.dmp

Filesize
4KB

Download
memory/3392-200-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/3392-195-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/3392-151-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3536-194-0x000000001B3D0000-0x000000001B3D2000-memory.dmp

Filesize
8KB

Download
memory/3536-145-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/3536-174-0x0000000000B30000-0x0000000000B46000-memory.dmp

Filesize
88KB

Download
memory/3612-476-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/3688-208-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3688-356-0x0000000004DC0000-0x0000000004E36000-memory.dmp

Filesize
472KB

Download
memory/3900-172-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/3900-159-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/3900-210-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/3988-235-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/3988-267-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/3988-230-0x00000000777D0000-0x000000007795E000-memory.dmp

Filesize
1.6MB

Download
memory/4120-510-0x0000000004E40000-0x0000000005446000-memory.dmp

Filesize
6.0MB

Download
memory/4176-283-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4176-347-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4176-220-0x0000000003950000-0x000000000398C000-memory.dmp

Filesize
240KB

Download
memory/4176-254-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/4176-351-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4176-336-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4176-222-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4176-227-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4176-236-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4176-238-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4176-234-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4176-341-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4176-338-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4176-289-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/4176-243-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4176-245-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4176-246-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4176-242-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/4176-240-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4176-232-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4260-409-0x00000000058B0000-0x0000000005EB6000-memory.dmp

Filesize
6.0MB

Download
memory/4332-497-0x0000000004F10000-0x0000000005516000-memory.dmp

Filesize
6.0MB

Download
memory/4392-295-0x0000000004F30000-0x0000000005536000-memory.dmp

Filesize
6.0MB

Download
memory/4392-247-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4400-426-0x0000000005360000-0x0000000005966000-memory.dmp

Filesize
6.0MB

Download
memory/4428-263-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4428-306-0x0000000004D00000-0x0000000005306000-memory.dmp

Filesize
6.0MB

Download
memory/4472-274-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4472-314-0x00000000051C0000-0x00000000057C6000-memory.dmp

Filesize
6.0MB

Download
memory/4548-436-0x00000000052D0000-0x00000000057CE000-memory.dmp

Filesize
5.0MB

Download
memory/4556-432-0x00000000055D0000-0x0000000005BD6000-memory.dmp

Filesize
6.0MB

Download
memory/4572-493-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4572-279-0x0000000001170000-0x0000000001182000-memory.dmp

Filesize
72KB

Download
memory/4572-261-0x0000000000D70000-0x0000000000D80000-memory.dmp

Filesize
64KB

Download
memory/4576-479-0x00000000056B0000-0x0000000005CB6000-memory.dmp

Filesize
6.0MB

Download
memory/4636-333-0x0000000004FB0000-0x00000000055B6000-memory.dmp

Filesize
6.0MB

Download
memory/4668-273-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/4768-343-0x0000000005810000-0x0000000005E16000-memory.dmp

Filesize
6.0MB

Download
memory/4836-450-0x0000000005840000-0x0000000005E46000-memory.dmp

Filesize
6.0MB

Download
memory/4988-467-0x00000000050A0000-0x00000000056A6000-memory.dmp

Filesize
6.0MB

Download
memory/5020-372-0x0000000004F50000-0x0000000005556000-memory.dmp

Filesize
6.0MB

Download
memory/5072-405-0x00000000052C0000-0x00000000057BE000-memory.dmp

Filesize
5.0MB

Download
memory/5088-386-0x00000000050E0000-0x00000000056E6000-memory.dmp

Filesize
6.0MB

Download