glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1MiiSE0eWth6wm_GghP3xbdx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1MiiSE0eWth6wm_GghP3xbdx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wOpPHGW3jpm0iP3zFLPYUUjK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wOpPHGW3jpm0iP3zFLPYUUjK.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup (23).exe

Loads dropped DLL 2 IoCs

pid	Process
5116	LGwjd2aG1p_Fn0wEjzMALfWS.tmp
5116	LGwjd2aG1p_Fn0wEjzMALfWS.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral32/files/0x000100000001ab82-141.dat	themida
behavioral32/files/0x000100000001ab9d-165.dat	themida
behavioral32/files/0x000100000001ab82-177.dat	themida
behavioral32/memory/3716-236-0x00000000002D0000-0x00000000002D1000-memory.dmp	themida
behavioral32/memory/2696-237-0x0000000000350000-0x0000000000351000-memory.dmp	themida
behavioral32/files/0x000100000001ab9d-198.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1MiiSE0eWth6wm_GghP3xbdx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wOpPHGW3jpm0iP3zFLPYUUjK.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ipinfo.io
30	ipinfo.io
109	ip-api.com
119	ipinfo.io
120	ipinfo.io
180	ipinfo.io
996	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3716	1MiiSE0eWth6wm_GghP3xbdx.exe
2696	wOpPHGW3jpm0iP3zFLPYUUjK.exe

Suspicious use of SetThreadContext 25 IoCs

description	pid	Process	procid_target
PID 2884 set thread context of 4588	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	108
PID 3036 set thread context of 4612	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	111
PID 740 set thread context of 4648	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	110
PID 3356 set thread context of 4660	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	109
PID 3036 set thread context of 4904	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	192
PID 2884 set thread context of 4140	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	188
PID 740 set thread context of 4284	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	187
PID 3036 set thread context of 1168	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	119
PID 3356 set thread context of 4672	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	184
PID 2884 set thread context of 4552	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	121
PID 3036 set thread context of 4408	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	182
PID 740 set thread context of 4224	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	122
PID 3356 set thread context of 4144	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	181
PID 2884 set thread context of 4340	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	195
PID 3036 set thread context of 4860	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	179
PID 740 set thread context of 4872	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	123
PID 3356 set thread context of 4016	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	178
PID 2884 set thread context of 204	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	177
PID 3036 set thread context of 2180	3036	GIc2CSgj6ScHinerj9hR8NcO.exe	124
PID 740 set thread context of 3168	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	125
PID 3356 set thread context of 4288	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	176
PID 3424 set thread context of 5268	3424	jOue5gLe60_qLVPHfl_lLMKn.exe	127
PID 2884 set thread context of 5224	2884	PQcFnF9fPXQuZPuPO7K2E84n.exe	126
PID 740 set thread context of 5360	740	pNAoFqb8ew2zTrZbkA1dM5Z3.exe	128
PID 3356 set thread context of 5392	3356	nZ6GyujXls_1yYcOxX1mYv3h.exe	174

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	fHvu1_313SSyfasoz7eEyeGa.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	fHvu1_313SSyfasoz7eEyeGa.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	fHvu1_313SSyfasoz7eEyeGa.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	fHvu1_313SSyfasoz7eEyeGa.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	fHvu1_313SSyfasoz7eEyeGa.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	uMBV9Uk208kTUTi4Eb9jNUG5.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	uMBV9Uk208kTUTi4Eb9jNUG5.exe
File created	C:\Program Files\Mozilla Firefox\DotNetZip-1hmwxru4.tmp	_x3mqL9GQPq5XGXLsCOzxE1j.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 34 IoCs

pid	pid_target	Process	procid_target
4104	4648	WerFault.exe	110
6008	3784	WerFault.exe	85
5868	3516	WerFault.exe	80
3788	3784	WerFault.exe	85
4760	5540	WerFault.exe	141
3484	3784	WerFault.exe	85
4484	3516	WerFault.exe	80
2088	4836	WerFault.exe	115
4300	3516	WerFault.exe	80
5540	3784	WerFault.exe	85
6284	5948	WerFault.exe	165
7092	3516	WerFault.exe	80
7348	3784	WerFault.exe	85
7480	6316	WerFault.exe	223
5244	3784	WerFault.exe	85
7304	3516	WerFault.exe	80
8292	5860	WerFault.exe	256
8588	7552	WerFault.exe	258
8584	3784	WerFault.exe	85
9620	9240	WerFault.exe	296
9824	9468	WerFault.exe	298
7748	7612	WerFault.exe	321
2244	7596	WerFault.exe	326
1948	3516	WerFault.exe	80
3208	3516	WerFault.exe	80
11720	6008	WerFault.exe	378
12280	11900	WerFault.exe	385
11520	3008	WerFault.exe	92
11208	14092	WerFault.exe	451
9572	14308	WerFault.exe	462
12860	13108	WerFault.exe	489
16356	15588	WerFault.exe	514
16396	11528	WerFault.exe	520
17432	6264	WerFault.exe	172

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jOue5gLe60_qLVPHfl_lLMKn.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jOue5gLe60_qLVPHfl_lLMKn.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jOue5gLe60_qLVPHfl_lLMKn.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4680	schtasks.exe
4704	schtasks.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
7420	taskkill.exe
20536	taskkill.exe
20528	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	177	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	229	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	998	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
796	Setup (23).exe
796	Setup (23).exe
3692	_x3mqL9GQPq5XGXLsCOzxE1j.exe
3692	_x3mqL9GQPq5XGXLsCOzxE1j.exe
5268	jOue5gLe60_qLVPHfl_lLMKn.exe
5268	jOue5gLe60_qLVPHfl_lLMKn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	fNCiDoo9oKc7zyLPhb6JnMcq.exe
Token: SeDebugPrivilege	2940	9E5KV_QWrb3dTWJ1RhIaqsYN.exe
Token: SeDebugPrivilege	3692	_x3mqL9GQPq5XGXLsCOzxE1j.exe
Token: SeDebugPrivilege	2696	wOpPHGW3jpm0iP3zFLPYUUjK.exe
Token: SeDebugPrivilege	4612	GIc2CSgj6ScHinerj9hR8NcO.exe
Token: SeDebugPrivilege	3716	1MiiSE0eWth6wm_GghP3xbdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5116	LGwjd2aG1p_Fn0wEjzMALfWS.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 3340	796	Setup (23).exe	79
PID 796 wrote to memory of 3340	796	Setup (23).exe	79
PID 796 wrote to memory of 3424	796	Setup (23).exe	78
PID 796 wrote to memory of 3424	796	Setup (23).exe	78
PID 796 wrote to memory of 3424	796	Setup (23).exe	78
PID 796 wrote to memory of 664	796	Setup (23).exe	83
PID 796 wrote to memory of 664	796	Setup (23).exe	83
PID 796 wrote to memory of 664	796	Setup (23).exe	83
PID 796 wrote to memory of 2884	796	Setup (23).exe	82
PID 796 wrote to memory of 2884	796	Setup (23).exe	82
PID 796 wrote to memory of 2884	796	Setup (23).exe	82
PID 796 wrote to memory of 2336	796	Setup (23).exe	81
PID 796 wrote to memory of 2336	796	Setup (23).exe	81
PID 796 wrote to memory of 2336	796	Setup (23).exe	81
PID 796 wrote to memory of 3516	796	Setup (23).exe	80
PID 796 wrote to memory of 3516	796	Setup (23).exe	80
PID 796 wrote to memory of 3516	796	Setup (23).exe	80
PID 796 wrote to memory of 3784	796	Setup (23).exe	85
PID 796 wrote to memory of 3784	796	Setup (23).exe	85
PID 796 wrote to memory of 3784	796	Setup (23).exe	85
PID 796 wrote to memory of 3148	796	Setup (23).exe	84
PID 796 wrote to memory of 3148	796	Setup (23).exe	84
PID 796 wrote to memory of 3148	796	Setup (23).exe	84
PID 796 wrote to memory of 3716	796	Setup (23).exe	88
PID 796 wrote to memory of 3716	796	Setup (23).exe	88
PID 796 wrote to memory of 3716	796	Setup (23).exe	88
PID 796 wrote to memory of 1636	796	Setup (23).exe	91
PID 796 wrote to memory of 1636	796	Setup (23).exe	91
PID 796 wrote to memory of 1636	796	Setup (23).exe	91
PID 796 wrote to memory of 1404	796	Setup (23).exe	90
PID 796 wrote to memory of 1404	796	Setup (23).exe	90
PID 796 wrote to memory of 1404	796	Setup (23).exe	90
PID 796 wrote to memory of 3356	796	Setup (23).exe	89
PID 796 wrote to memory of 3356	796	Setup (23).exe	89
PID 796 wrote to memory of 3356	796	Setup (23).exe	89
PID 796 wrote to memory of 3636	796	Setup (23).exe	97
PID 796 wrote to memory of 3636	796	Setup (23).exe	97
PID 796 wrote to memory of 3284	796	Setup (23).exe	101
PID 796 wrote to memory of 3284	796	Setup (23).exe	101
PID 796 wrote to memory of 3284	796	Setup (23).exe	101
PID 796 wrote to memory of 740	796	Setup (23).exe	96
PID 796 wrote to memory of 740	796	Setup (23).exe	96
PID 796 wrote to memory of 740	796	Setup (23).exe	96
PID 796 wrote to memory of 3036	796	Setup (23).exe	98
PID 796 wrote to memory of 3036	796	Setup (23).exe	98
PID 796 wrote to memory of 3036	796	Setup (23).exe	98
PID 796 wrote to memory of 2696	796	Setup (23).exe	99
PID 796 wrote to memory of 2696	796	Setup (23).exe	99
PID 796 wrote to memory of 2696	796	Setup (23).exe	99
PID 796 wrote to memory of 3344	796	Setup (23).exe	100
PID 796 wrote to memory of 3344	796	Setup (23).exe	100
PID 796 wrote to memory of 3344	796	Setup (23).exe	100
PID 796 wrote to memory of 3692	796	Setup (23).exe	95
PID 796 wrote to memory of 3692	796	Setup (23).exe	95
PID 796 wrote to memory of 3692	796	Setup (23).exe	95
PID 796 wrote to memory of 2940	796	Setup (23).exe	94
PID 796 wrote to memory of 2940	796	Setup (23).exe	94
PID 796 wrote to memory of 3008	796	Setup (23).exe	92
PID 796 wrote to memory of 3008	796	Setup (23).exe	92
PID 796 wrote to memory of 3008	796	Setup (23).exe	92
PID 3148 wrote to memory of 4120	3148	ax6eP5LK7FCtsrUK20W6WBwt.exe	102
PID 3148 wrote to memory of 4120	3148	ax6eP5LK7FCtsrUK20W6WBwt.exe	102
PID 3148 wrote to memory of 4120	3148	ax6eP5LK7FCtsrUK20W6WBwt.exe	102
PID 3284 wrote to memory of 4340	3284	fHvu1_313SSyfasoz7eEyeGa.exe	195

C:\Users\Admin\AppData\Local\Temp\Setup (23).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (23).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\Documents\jOue5gLe60_qLVPHfl_lLMKn.exe
  "C:\Users\Admin\Documents\jOue5gLe60_qLVPHfl_lLMKn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3424
- - C:\Users\Admin\Documents\jOue5gLe60_qLVPHfl_lLMKn.exe
    "C:\Users\Admin\Documents\jOue5gLe60_qLVPHfl_lLMKn.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:5268
- C:\Users\Admin\Documents\1PMmxXIiVOGSWEDveCFRRENJ.exe
  "C:\Users\Admin\Documents\1PMmxXIiVOGSWEDveCFRRENJ.exe"
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Users\Admin\Documents\ugDJq9EgAcSXMP65DYh51puK.exe
  "C:\Users\Admin\Documents\ugDJq9EgAcSXMP65DYh51puK.exe"
  2⤵
  - Executes dropped EXE
  PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 384
    3⤵
    - Program crash
    PID:5868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 388
    3⤵
    - Program crash
    PID:4484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 400
    3⤵
    - Program crash
    PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 620
    3⤵
    - Program crash
    PID:7092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 640
    3⤵
    - Program crash
    PID:7304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 688
    3⤵
    - Program crash
    PID:1948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 700
    3⤵
    - Program crash
    PID:3208
- C:\Users\Admin\Documents\p94iIWMNBrUOojVw_LSj1UKs.exe
  "C:\Users\Admin\Documents\p94iIWMNBrUOojVw_LSj1UKs.exe"
  2⤵
  - Executes dropped EXE
  PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\51320232767.exe"
    3⤵
    PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\51320232767.exe
      "C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\51320232767.exe"
      4⤵
      PID:15612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\55546478772.exe" /mix
    3⤵
    PID:21552
  - - C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\55546478772.exe
      "C:\Users\Admin\AppData\Local\Temp\{u6WV-quuaP-z6yd-ZSAT0}\55546478772.exe" /mix
      4⤵
      PID:21944
- C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
  "C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2884
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:4588
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:4552
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:5224
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5588
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5992
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:4136
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5188
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5416
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5436
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:4512
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:6228
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:204
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:4340
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:4140
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    - Executes dropped EXE
    PID:4800
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:6564
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:6948
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:6484
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5000
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:1180
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:7236
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:7716
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8064
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:7792
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 24
      4⤵
      Program crash
      PID:8292
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8240
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8752
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9120
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8412
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9136
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8872
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9196
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9240
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9240 -s 24
      4⤵
      Program crash
      PID:9620
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9584
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9884
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:7144
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9680
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9228
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8048
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:2044
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:1948
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9152
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:7704
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5900
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:10408
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:10744
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11112
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9496
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:1640
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:8456
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:6008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 24
      4⤵
      Program crash
      PID:11720
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11700
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11980
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11440
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9544
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:4704
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12352
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12780
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13204
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12608
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:9792
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12980
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12552
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13472
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13880
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13376
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14092 -s 24
      4⤵
      Program crash
      PID:11208
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:3268
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13836
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11708
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14460
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14968
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:12836
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14756
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15260
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13108 -s 24
      4⤵
      Program crash
      PID:12860
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15040
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14748
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15684
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16120
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15588 -s 24
      4⤵
      Program crash
      PID:16356
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15940
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16356
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16548
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16940
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:17392
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16712
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:17012
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:17624
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:18048
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:17584
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5488
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5164
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:18924
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:19452
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:19360
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15800
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5884
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11072
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:11716
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14556
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5108
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:19568
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:20036
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16696
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:20152
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:4364
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:5952
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:20760
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21196
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:20548
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:15088
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21352
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21712
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:22140
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21600
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:13952
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:22192
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:22100
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21952
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:14232
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:16612
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:23240
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:19780
- - C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    C:\Users\Admin\Documents\PQcFnF9fPXQuZPuPO7K2E84n.exe
    3⤵
    PID:21364
- C:\Users\Admin\Documents\uMBV9Uk208kTUTi4Eb9jNUG5.exe
  "C:\Users\Admin\Documents\uMBV9Uk208kTUTi4Eb9jNUG5.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4704
- C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe
  "C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\ax6eP5LK7FCtsrUK20W6WBwt.exe" ) do taskkill /iM "%~NXm" -F
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
        
        IQ0v_FE_.ExE -poRsuYEMryiLi
        5⤵
        
        PID:7204
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
        6⤵
        
        PID:14080
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "ax6eP5LK7FCtsrUK20W6WBwt.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:7420
- C:\Users\Admin\Documents\hp3okJoHHoLoH5WDI2vIh2m5.exe
  "C:\Users\Admin\Documents\hp3okJoHHoLoH5WDI2vIh2m5.exe"
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 660
    3⤵
    - Program crash
    PID:6008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 648
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 680
    3⤵
    - Program crash
    PID:3484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 660
    3⤵
    - Program crash
    PID:5540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 896
    3⤵
    - Program crash
    PID:7348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1060
    3⤵
    - Program crash
    PID:5244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1160
    3⤵
    - Program crash
    PID:8584
- C:\Users\Admin\Documents\1MiiSE0eWth6wm_GghP3xbdx.exe
  "C:\Users\Admin\Documents\1MiiSE0eWth6wm_GghP3xbdx.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
  "C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3356
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4660
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4964
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:5760
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6100
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4400
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6040
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4652
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:5252
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4148
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:5664
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:5392
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4288
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4016
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4144
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:4672
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    - Executes dropped EXE
    PID:712
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6376
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6704
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7108
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6572
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7084
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4984
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4596
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7572
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7856
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7224
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7956
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8136
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8320
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8664
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8956
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:1360
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8812
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6412
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8908
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4272
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9324
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9596
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9916
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4736
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10100
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7612 -s 24
      4⤵
      Program crash
      PID:7748
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:7596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7596 -s 24
      4⤵
      Program crash
      PID:2244
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:6104
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9540
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:3928
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:4608
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10276
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10564
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10884
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9072
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10616
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:844
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:5172
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11272
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11692
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11964
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11336
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11972
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10668
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12332
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12756
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13176
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12656
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:10244
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12892
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12964
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13340
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13816
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14276
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13544
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9860
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13760
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14308 -s 24
      4⤵
      Program crash
      PID:9572
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:12420
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14720
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15160
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14536
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14836
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14864
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:13060
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:14972
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15444
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15928
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15004
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15836
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11528 -s 24
      4⤵
      Program crash
      PID:16396
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:15328
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16712
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:17068
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16176
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:17316
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16628
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:17676
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18148
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16284
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18260
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18192
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18948
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:19368
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:19196
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18964
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:17320
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:8248
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16664
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:800
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16228
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:16240
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:19656
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20156
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:19492
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20452
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20384
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:11956
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20892
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:21336
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:21020
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20548
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:19908
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:21940
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:22396
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:22116
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:9880
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:22416
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:22016
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20208
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18268
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:18392
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:23136
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:20512
- - C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    C:\Users\Admin\Documents\nZ6GyujXls_1yYcOxX1mYv3h.exe
    3⤵
    PID:23544
- C:\Users\Admin\Documents\uSitXfi2YjHeo5IRIWMtsovA.exe
  "C:\Users\Admin\Documents\uSitXfi2YjHeo5IRIWMtsovA.exe"
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Users\Admin\Documents\uSitXfi2YjHeo5IRIWMtsovA.exe
    "C:\Users\Admin\Documents\uSitXfi2YjHeo5IRIWMtsovA.exe" -u
    3⤵
    PID:6096
- C:\Users\Admin\Documents\Ahww742KYKydQWd7XPOJm31t.exe
  "C:\Users\Admin\Documents\Ahww742KYKydQWd7XPOJm31t.exe"
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"
    3⤵
    PID:4836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 272
      4⤵
      Program crash
      PID:2088
- C:\Users\Admin\Documents\2TC47CusJinzFxE9IiSssH5S.exe
  "C:\Users\Admin\Documents\2TC47CusJinzFxE9IiSssH5S.exe"
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 904
    3⤵
    - Program crash
    PID:11520
- C:\Users\Admin\Documents\9E5KV_QWrb3dTWJ1RhIaqsYN.exe
  "C:\Users\Admin\Documents\9E5KV_QWrb3dTWJ1RhIaqsYN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Users\Admin\Documents\_x3mqL9GQPq5XGXLsCOzxE1j.exe
  "C:\Users\Admin\Documents\_x3mqL9GQPq5XGXLsCOzxE1j.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:8232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:8324
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8324.0.1433415438\2014369288" -parentBuildID 20200403170909 -prefsHandle 1396 -prefMapHandle 1392 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 8324 "\\.\pipe\gecko-crash-server-pipe.8324" 1532 gpu
        5⤵
        
        PID:18132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffade494f50,0x7ffade494f60,0x7ffade494f70
      4⤵
      PID:15576
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 3692 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_x3mqL9GQPq5XGXLsCOzxE1j.exe"
    3⤵
    PID:15292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3692
      4⤵
      Kills process with taskkill
      PID:20536
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 3692 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_x3mqL9GQPq5XGXLsCOzxE1j.exe"
    3⤵
    PID:20188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 3692
      4⤵
      Kills process with taskkill
      PID:20528
- C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
  "C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:740
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:4648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 24
      4⤵
      Program crash
      PID:4104
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:4224
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:4872
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:3168
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:5360
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:5716
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6056
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:5504
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:5312
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:1912
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6000
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:5948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 24
      4⤵
      Program crash
      PID:6284
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6216
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:1032
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:4284
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    - Executes dropped EXE
    PID:4936
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6488
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6868
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:3484
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:6852
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:4780
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:4304
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7296
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7688
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7648
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7320
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7552 -s 24
      4⤵
      Program crash
      PID:8588
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8548
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8864
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:5532
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:3844
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8304
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8288
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7832
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8744
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9524
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9780
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10132
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9500
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9824
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9456
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10012
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8012
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8492
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:4992
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8348
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9016
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10332
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10616
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10912
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10328
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10960
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10680
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11192
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10428
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11640
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11996
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8284
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12192
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:7604
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11416
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12616
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12992
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12464
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12848
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12468
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13288
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13232
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13576
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13944
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13176
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13996
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11064
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13996
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:14056
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12028
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:14832
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15240
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:14624
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15152
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:9224
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:14648
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:13304
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15520
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15980
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15364
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16044
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15716
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16448
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16788
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:17180
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16728
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16604
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:15960
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:17884
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:18360
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:17852
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8900
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:17916
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19148
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:8080
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16932
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:16624
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:11200
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:3568
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:18128
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:10400
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:12312
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19576
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:20096
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19536
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:20324
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19008
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19164
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:20844
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:21276
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:20632
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:21312
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:19132
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:21888
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:22372
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:21844
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:18300
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:22440
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:22088
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:18424
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:22316
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:20132
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:22660
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:23308
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:23000
- - C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    C:\Users\Admin\Documents\pNAoFqb8ew2zTrZbkA1dM5Z3.exe
    3⤵
    PID:23496
- C:\Users\Admin\Documents\fNCiDoo9oKc7zyLPhb6JnMcq.exe
  "C:\Users\Admin\Documents\fNCiDoo9oKc7zyLPhb6JnMcq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- - C:\Users\Admin\AppData\Roaming\4562650.exe
    "C:\Users\Admin\AppData\Roaming\4562650.exe"
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Roaming\4374681.exe
    "C:\Users\Admin\AppData\Roaming\4374681.exe"
    3⤵
    PID:8156
- - C:\Users\Admin\AppData\Roaming\3371692.exe
    "C:\Users\Admin\AppData\Roaming\3371692.exe"
    3⤵
    PID:7336
- - C:\Users\Admin\AppData\Roaming\8082541.exe
    "C:\Users\Admin\AppData\Roaming\8082541.exe"
    3⤵
    PID:6968
- - C:\Users\Admin\AppData\Roaming\1085530.exe
    "C:\Users\Admin\AppData\Roaming\1085530.exe"
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:15768
- C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
  "C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3036
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:1168
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:2180
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5504
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5768
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6112
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 24
      4⤵
      Program crash
      PID:4760
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5684
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5628
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:4228
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:3152
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6200
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:5192
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:4860
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:4408
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    - Executes dropped EXE
    PID:4904
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6464
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6828
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5008
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6988
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6956
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6316 -s 24
      4⤵
      Program crash
      PID:7480
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:7440
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:7752
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8084
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5740
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8060
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:4116
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8620
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8920
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:4264
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8744
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8960
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:4456
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8956
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8692
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9468
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9468 -s 24
      4⤵
      Program crash
      PID:9824
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9796
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10184
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9328
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10076
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9384
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9364
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:1240
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:3052
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:7728
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:2104
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:8252
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10520
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10832
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:11232
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10856
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:2296
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10272
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10664
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:11540
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:11900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11900 -s 24
      4⤵
      Program crash
      PID:12280
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12268
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:11696
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:11860
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:384
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12708
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13100
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9348
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12904
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:3840
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12752
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:9404
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13784
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14184
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13636
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14236
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13512
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13404
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13648
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14584
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15044
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12604
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15000
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:12396
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15096
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15288
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14908
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15552
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:16008
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:2684
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15972
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15616
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15836
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:16756
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:17144
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15036
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14740
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:15796
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:17808
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18276
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:17696
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:14592
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18408
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18976
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:19396
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:19256
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:1900
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:19096
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:13736
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:6176
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:7848
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:17100
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:7852
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:19788
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:20292
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:5828
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:488
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18144
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:20592
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:20980
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21416
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21232
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:20964
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21108
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21908
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:22448
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18416
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21208
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21604
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:18832
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:10204
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:16752
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:22572
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:23272
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:21032
- - C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    C:\Users\Admin\Documents\GIc2CSgj6ScHinerj9hR8NcO.exe
    3⤵
    PID:19880
- C:\Users\Admin\Documents\wOpPHGW3jpm0iP3zFLPYUUjK.exe
  "C:\Users\Admin\Documents\wOpPHGW3jpm0iP3zFLPYUUjK.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Users\Admin\Documents\R29VManQj4yd30dzZLsRINSj.exe
  "C:\Users\Admin\Documents\R29VManQj4yd30dzZLsRINSj.exe"
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Users\Admin\Documents\R29VManQj4yd30dzZLsRINSj.exe
    "C:\Users\Admin\Documents\R29VManQj4yd30dzZLsRINSj.exe"
    3⤵
    PID:6264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1464
      4⤵
      Program crash
      PID:17432
- C:\Users\Admin\Documents\fHvu1_313SSyfasoz7eEyeGa.exe
  "C:\Users\Admin\Documents\fHvu1_313SSyfasoz7eEyeGa.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4376
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:4416
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    - Executes dropped EXE
    PID:4340
- C:\Users\Admin\Documents\LGwjd2aG1p_Fn0wEjzMALfWS.exe
  "C:\Users\Admin\Documents\LGwjd2aG1p_Fn0wEjzMALfWS.exe"
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Users\Admin\AppData\Local\Temp\is-IEHIA.tmp\LGwjd2aG1p_Fn0wEjzMALfWS.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-IEHIA.tmp\LGwjd2aG1p_Fn0wEjzMALfWS.tmp" /SL5="$30294,138429,56832,C:\Users\Admin\Documents\LGwjd2aG1p_Fn0wEjzMALfWS.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\is-JE734.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-JE734.tmp\Setup.exe" /Verysilent
      4⤵
      PID:10488
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
        5⤵
        
        PID:22724
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        5⤵
        
        PID:22800
      - C:\Users\Admin\AppData\Local\Temp\is-UEH9G.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UEH9G.tmp\stats.tmp" /SL5="$10A90,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        6⤵
        
        PID:23212
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
        5⤵
        
        PID:22792
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
        5⤵
        
        PID:22784
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
        5⤵
        
        PID:22716
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        5⤵
        
        PID:22704
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        5⤵
        
        PID:22696
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery