dcrat | e8f1e825cd1da794257a8f1f38f291835b31d45ded1cace17953b4a4f3bbf040

Analysis

max time kernel
10s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Electron.exe
Size 61KB
Sample240604-2egcyadf2s
SHA256 e8f1e825cd1da794257a8f1f38f291835b31d45ded1cace17953b4a4f3bbf040
MD5 1ce13e423f57888a68c3c544460b13a4
SHA1 eb98c3220428ea3e5bf391f330af1317c839d258
SHA512 eb0da239fec584754fc720b50cd1668684e4eadbe86f267b6285806c79c045fa657aaf9e97c8e27c967207105180251c5e13b7eb213fa067ad301d4af316accb
SSDEEP 768:5vcc1E6Deh+l8qctQuC4jCqD1uu2wZy1PNQF1DCVTs85ECgm8Azet8AtZ:dCh+Oqmq/p1PqF1DCNs+EXAzeyAtZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5292	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5816	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5364	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	3872	schtasks.exe	171
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5372	3872	schtasks.exe	171

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0008000000023263-7.dat	dcrat
behavioral2/files/0x000800000002326c-38.dat	dcrat
behavioral2/memory/5904-40-0x0000000000190000-0x0000000000266000-memory.dmp	dcrat

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Electron.exe

Executes dropped EXE 6 IoCs

pid	Process
1976	Wave.exe
2016	Wave.exe
5428	Wave.exe
2616	Wave.exe
1448	Wave.exe
4360	Wave.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com
28	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5816	schtasks.exe
3732	schtasks.exe
3728	schtasks.exe
4564	schtasks.exe
3288	schtasks.exe
5364	schtasks.exe
5292	schtasks.exe
3468	schtasks.exe
2568	schtasks.exe
404	schtasks.exe
496	schtasks.exe
5372	schtasks.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
1656	reg.exe
6048	reg.exe
4452	reg.exe
2840	reg.exe
4288	reg.exe
3548	reg.exe
1304	reg.exe
3548	reg.exe
2208	reg.exe
4692	reg.exe
6056	reg.exe
2704	reg.exe
5416	reg.exe
2200	reg.exe
5192	reg.exe
2856	reg.exe
5096	reg.exe
1644	reg.exe
2420	reg.exe
464	reg.exe
4988	reg.exe
5492	reg.exe
220	reg.exe
6124	reg.exe
5040	reg.exe
2312	reg.exe
628	reg.exe
5632	reg.exe
5924	reg.exe
1812	reg.exe
3084	reg.exe
5100	reg.exe
5216	reg.exe
5544	reg.exe
6016	reg.exe
4120	reg.exe
5188	reg.exe
5292	reg.exe
5208	reg.exe
5848	reg.exe
4840	reg.exe
5604	reg.exe
5968	reg.exe
4380	reg.exe
5060	reg.exe
3564	reg.exe
5280	reg.exe
5488	reg.exe
4692	reg.exe
4168	reg.exe
4692	reg.exe
5432	reg.exe
760	reg.exe
3332	reg.exe
4956	reg.exe
5100	reg.exe
5256	reg.exe
2312	reg.exe
5188	reg.exe
5044	reg.exe
5404	reg.exe
4652	reg.exe
3744	reg.exe
1616	reg.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3544	Electron.exe
Token: SeDebugPrivilege	1952	Electron.exe
Token: SeDebugPrivilege	772	Electron.exe
Token: SeDebugPrivilege	5424	Electron.exe
Token: SeDebugPrivilege	5364	Electron.exe
Token: SeDebugPrivilege	4608	Electron.exe
Token: SeDebugPrivilege	4640	Electron.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1976	3544	Electron.exe	91
PID 3544 wrote to memory of 1976	3544	Electron.exe	91
PID 3544 wrote to memory of 1976	3544	Electron.exe	91
PID 3544 wrote to memory of 1952	3544	Electron.exe	92
PID 3544 wrote to memory of 1952	3544	Electron.exe	92
PID 1952 wrote to memory of 2016	1952	Electron.exe	93
PID 1952 wrote to memory of 2016	1952	Electron.exe	93
PID 1952 wrote to memory of 2016	1952	Electron.exe	93
PID 1952 wrote to memory of 772	1952	Electron.exe	148
PID 1952 wrote to memory of 772	1952	Electron.exe	148
PID 772 wrote to memory of 5428	772	Electron.exe	283
PID 772 wrote to memory of 5428	772	Electron.exe	283
PID 772 wrote to memory of 5428	772	Electron.exe	283
PID 772 wrote to memory of 5424	772	Electron.exe	96
PID 772 wrote to memory of 5424	772	Electron.exe	96
PID 5424 wrote to memory of 2616	5424	Electron.exe	97
PID 5424 wrote to memory of 2616	5424	Electron.exe	97
PID 5424 wrote to memory of 2616	5424	Electron.exe	97
PID 5424 wrote to memory of 5364	5424	Electron.exe	364
PID 5424 wrote to memory of 5364	5424	Electron.exe	364
PID 5364 wrote to memory of 1448	5364	Electron.exe	203
PID 5364 wrote to memory of 1448	5364	Electron.exe	203
PID 5364 wrote to memory of 1448	5364	Electron.exe	203
PID 5364 wrote to memory of 4608	5364	Electron.exe	893
PID 5364 wrote to memory of 4608	5364	Electron.exe	893
PID 4608 wrote to memory of 4360	4608	Electron.exe	750
PID 4608 wrote to memory of 4360	4608	Electron.exe	750
PID 4608 wrote to memory of 4360	4608	Electron.exe	750
PID 4608 wrote to memory of 4640	4608	Electron.exe	102
PID 4608 wrote to memory of 4640	4608	Electron.exe	102

C:\Users\Admin\AppData\Local\Temp\Electron.exe
"C:\Users\Admin\AppData\Local\Temp\Electron.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\Wave.exe
  "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
    3⤵
    PID:2512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
      4⤵
      PID:1096
    - - C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        5⤵
        
        PID:5896
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        
        PID:628
- C:\Users\Admin\AppData\Local\Temp\Electron.exe
  "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
      4⤵
      PID:2180
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        5⤵
        
        PID:1312
      - C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        6⤵
        
        PID:644
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        
        PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Electron.exe
    "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\Wave.exe
      "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
      4⤵
      Executes dropped EXE
      PID:5428
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        5⤵
        
        PID:5544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        6⤵
        
        PID:4356
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        7⤵
        
        PID:5904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4kaJnY8jMt.bat"
        8⤵
        
        PID:1448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4124
        
        C:\Recovery\WindowsRE\cmd.exe
        
        "C:\Recovery\WindowsRE\cmd.exe"
        9⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        7⤵
        
        PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Electron.exe
      "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
      4⤵
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        5⤵
        Executes dropped EXE
        
        PID:2616
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        6⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        7⤵
        
        PID:456
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        8⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        8⤵
        Modifies registry key
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        6⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        7⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        8⤵
        
        PID:3132
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        9⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        9⤵
        Modifies registry key
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        6⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        7⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        8⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        9⤵
        
        PID:2952
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        10⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        10⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        8⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        9⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        10⤵
        
        PID:4420
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        11⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        11⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        9⤵
        
        PID:412
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        10⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        11⤵
        
        PID:4996
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        12⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        12⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        9⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        10⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        11⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        12⤵
        
        PID:5136
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        13⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        13⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        10⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        11⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        12⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        13⤵
        
        PID:5608
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        14⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        14⤵
        Modifies registry key
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        11⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        12⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        13⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        14⤵
        
        PID:5944
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        15⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        15⤵
        Modifies registry key
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        12⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        13⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        14⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        15⤵
        
        PID:368
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        16⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        16⤵
        Modifies registry key
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        13⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        14⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        15⤵
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        16⤵
        
        PID:712
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        17⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        17⤵
        Modifies registry key
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        14⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        15⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        16⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        17⤵
        
        PID:3100
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        18⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        18⤵
        Modifies registry key
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        15⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        16⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        17⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        18⤵
        
        PID:5512
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        19⤵
        
        PID:404
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        19⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        16⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        17⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        18⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        19⤵
        
        PID:1972
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        20⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        20⤵
        Modifies registry key
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        17⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        18⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        19⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        20⤵
        
        PID:4868
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        21⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        21⤵
        Modifies registry key
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        18⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        19⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        20⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        21⤵
        
        PID:5324
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        22⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        22⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        19⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        20⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        21⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        22⤵
        
        PID:5316
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        23⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        23⤵
        Modifies registry key
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        20⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        21⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        22⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        23⤵
        
        PID:5992
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        24⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        24⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        21⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        22⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        23⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        24⤵
        
        PID:2344
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        25⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        25⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        22⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        23⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        24⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        25⤵
        
        PID:5020
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        26⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        26⤵
        Modifies registry key
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        23⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        24⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        25⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        26⤵
        
        PID:4764
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        27⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        27⤵
        Modifies registry key
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        24⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        25⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        26⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        27⤵
        
        PID:1152
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        28⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        28⤵
        Modifies registry key
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        25⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        26⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        27⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        28⤵
        
        PID:3744
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        29⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        29⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        26⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        27⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        28⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        29⤵
        
        PID:2160
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        30⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        30⤵
        Modifies registry key
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        27⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        28⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        29⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        30⤵
        
        PID:3332
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        31⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        31⤵
        Modifies registry key
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        28⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        29⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        30⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        31⤵
        
        PID:1204
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        32⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        32⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        29⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        30⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        31⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        32⤵
        
        PID:5300
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        33⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        33⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        30⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        31⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        32⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        33⤵
        
        PID:5500
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        34⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        34⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        31⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        32⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        33⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        34⤵
        
        PID:4860
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        35⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        35⤵
        Modifies registry key
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        32⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        33⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        34⤵
        
        PID:216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        35⤵
        
        PID:2548
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        36⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        36⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        33⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        34⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        35⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        36⤵
        
        PID:2816
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        37⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        37⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        34⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        35⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        36⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        37⤵
        
        PID:5312
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        38⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        38⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        35⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        36⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        37⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        38⤵
        
        PID:3944
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        39⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        39⤵
        Modifies registry key
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        36⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        37⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        38⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        39⤵
        
        PID:4492
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        40⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        40⤵
        Modifies registry key
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        37⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        38⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        39⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        40⤵
        
        PID:888
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        41⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        41⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        38⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        39⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        40⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        41⤵
        
        PID:3272
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        42⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        42⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        39⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        40⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        41⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        42⤵
        
        PID:4716
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        43⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        43⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        40⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        41⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        42⤵
        
        PID:228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        43⤵
        
        PID:4072
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        44⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        44⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        41⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        42⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        43⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        44⤵
        
        PID:2208
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        45⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        45⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        42⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        43⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        44⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        45⤵
        
        PID:5912
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        46⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        46⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        43⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        44⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        45⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        46⤵
        
        PID:5936
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        47⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        47⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        44⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        45⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        46⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        47⤵
        
        PID:5416
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        48⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        48⤵
        Modifies registry key
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        45⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        46⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        47⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        48⤵
        
        PID:4440
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        49⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        49⤵
        Modifies registry key
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        46⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        47⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        48⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        49⤵
        
        PID:5196
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        50⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        50⤵
        Modifies registry key
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        47⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        48⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        49⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        50⤵
        
        PID:3060
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        51⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        51⤵
        Modifies registry key
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        48⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        49⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        50⤵
        
        PID:368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        51⤵
        
        PID:6136
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        52⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        52⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        49⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        50⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        51⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        52⤵
        
        PID:2592
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        53⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        53⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        50⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        51⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        52⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        53⤵
        
        PID:1016
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        54⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        54⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        51⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        52⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        53⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        54⤵
        
        PID:3108
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        55⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        55⤵
        Modifies registry key
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        52⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        53⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        54⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        55⤵
        
        PID:5544
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        56⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        56⤵
        Modifies registry key
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        53⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        54⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        55⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        56⤵
        
        PID:5156
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        57⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        57⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        54⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        55⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        56⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        57⤵
        
        PID:748
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        58⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        58⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        55⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        56⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        57⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        58⤵
        
        PID:972
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        59⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        59⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        56⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        57⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        58⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        59⤵
        
        PID:2308
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        60⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        60⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        57⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        58⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        59⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        60⤵
        
        PID:4468
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        61⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        61⤵
        Modifies registry key
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        58⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        59⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        60⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        61⤵
        
        PID:5504
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        62⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        62⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        59⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        60⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        61⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        62⤵
        
        PID:864
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        63⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        63⤵
        Modifies registry key
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        60⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        61⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        62⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        63⤵
        
        PID:4256
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        64⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        64⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        61⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        62⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        63⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        64⤵
        
        PID:1204
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        65⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        65⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        62⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        63⤵
        
        PID:872
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        64⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        65⤵
        
        PID:6052
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        66⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        66⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        63⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        64⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        65⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        66⤵
        
        PID:3564
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        67⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        67⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        64⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        65⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        66⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        67⤵
        
        PID:1376
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        68⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        68⤵
        Modifies registry key
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        65⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        66⤵
        
        PID:840
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        67⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        68⤵
        
        PID:4588
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        69⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        69⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        66⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        67⤵
        
        PID:772
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        68⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        69⤵
        
        PID:2852
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        70⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        70⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        67⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        68⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        69⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        70⤵
        
        PID:2640
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        71⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        71⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        68⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        69⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        70⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        71⤵
        
        PID:1656
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        72⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        72⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        69⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        70⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        71⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        72⤵
        
        PID:4476
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        73⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        73⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        70⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        71⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        72⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        73⤵
        
        PID:2556
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        74⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        74⤵
        Modifies registry key
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        71⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        72⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        73⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        74⤵
        
        PID:4044
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        75⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        75⤵
        Modifies registry key
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        72⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        73⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        74⤵
        
        PID:496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        75⤵
        
        PID:3816
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        76⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        76⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        73⤵
        
        PID:1856
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        74⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        75⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        76⤵
        
        PID:5544
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        77⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        77⤵
        
        PID:116
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        74⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        75⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        76⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        77⤵
        
        PID:3988
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        78⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        78⤵
        Modifies registry key
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        75⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        76⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        77⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        78⤵
        
        PID:3300
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        79⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        79⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        76⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        77⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        78⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        79⤵
        
        PID:216
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        80⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        80⤵
        Modifies registry key
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        77⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        78⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        79⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        80⤵
        
        PID:5960
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        81⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        81⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        78⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        79⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        80⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        81⤵
        
        PID:5888
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        82⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        82⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        79⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        80⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        81⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        82⤵
        
        PID:5492
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        83⤵
        
        PID:220
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        83⤵
        Modifies registry key
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        80⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        81⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        82⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        83⤵
        
        PID:5604
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        84⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        84⤵
        Modifies registry key
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        81⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        82⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        83⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        84⤵
        
        PID:3388
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        85⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        85⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        82⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        83⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        84⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        85⤵
        
        PID:3248
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        86⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        86⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        83⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        84⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        85⤵
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        86⤵
        
        PID:1280
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        87⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        87⤵
        Modifies registry key
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        84⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        85⤵
        
        PID:760
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        86⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        87⤵
        
        PID:4188
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        88⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        88⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        85⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        86⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        87⤵
        
        PID:432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        88⤵
        
        PID:5508
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        89⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        89⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        86⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        87⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        88⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        89⤵
        
        PID:5964
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        90⤵
        
        PID:712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        90⤵
        Modifies registry key
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        87⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        88⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        89⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        90⤵
        
        PID:4380
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        91⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        91⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        88⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        89⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        90⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        91⤵
        
        PID:2412
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        92⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        92⤵
        Modifies registry key
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        89⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        90⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        91⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        92⤵
        
        PID:432
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        93⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        93⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        90⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        91⤵
        
        PID:532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        92⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        93⤵
        
        PID:3396
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        94⤵
        
        PID:556
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        94⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        91⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        92⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        93⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        94⤵
        
        PID:5908
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        95⤵
        
        PID:340
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        95⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        92⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        93⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        94⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        95⤵
        
        PID:5432
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        96⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        96⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        93⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        94⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        95⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        96⤵
        
        PID:3732
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        97⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        97⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        94⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        95⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        96⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        97⤵
        
        PID:2040
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        98⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        98⤵
        Modifies registry key
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        95⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        96⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        97⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        98⤵
        
        PID:404
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        99⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        99⤵
        Modifies registry key
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        96⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        97⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        98⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        99⤵
        
        PID:5212
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        100⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        100⤵
        Modifies registry key
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        97⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        98⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        99⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        100⤵
        
        PID:4124
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        101⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        101⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        98⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        99⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        100⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        101⤵
        
        PID:5544
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        102⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        102⤵
        Modifies registry key
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        99⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        100⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        101⤵
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        102⤵
        
        PID:4892
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        103⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        103⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        100⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        101⤵
        
        PID:656
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        102⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        103⤵
        
        PID:1984
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        104⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        104⤵
        Modifies registry key
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        101⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        102⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        103⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        104⤵
        
        PID:700
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        105⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        105⤵
        Modifies registry key
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        102⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        103⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        104⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        105⤵
        
        PID:1084
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        106⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        106⤵
        Modifies registry key
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        103⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        104⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        105⤵
        
        PID:416
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        106⤵
        
        PID:5100
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        107⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        107⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        104⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        105⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        106⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        107⤵
        
        PID:3284
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        108⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        108⤵
        Modifies registry key
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        105⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        106⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        107⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        108⤵
        
        PID:864
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        109⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        109⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        106⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        107⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        108⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        109⤵
        
        PID:4816
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        110⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        110⤵
        Modifies registry key
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        107⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        108⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        109⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        110⤵
        
        PID:1484
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        111⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        111⤵
        Modifies registry key
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        108⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        109⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        110⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        111⤵
        
        PID:184
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        112⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        112⤵
        Modifies registry key
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        109⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        110⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        111⤵
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        112⤵
        
        PID:6136
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        113⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        113⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        110⤵
        
        PID:184
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        111⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        112⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        113⤵
        
        PID:3040
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        114⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        114⤵
        Modifies registry key
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        111⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        112⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        113⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        114⤵
        
        PID:4692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        115⤵
        
        PID:4608
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        115⤵
        
        PID:628
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        115⤵
        Modifies registry key
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        112⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        113⤵
        
        PID:644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        114⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        115⤵
        
        PID:2164
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        116⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        116⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        113⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        114⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        115⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        116⤵
        
        PID:4408
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        117⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        117⤵
        Modifies registry key
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        114⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        115⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        116⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        117⤵
        
        PID:1704
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        118⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        118⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        115⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        116⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        117⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        118⤵
        
        PID:3076
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        119⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        119⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        116⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        117⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        118⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        119⤵
        
        PID:4568
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        120⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        120⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        117⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        118⤵
        
        PID:404
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        119⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        120⤵
        
        PID:1976
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        121⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        121⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        118⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        119⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        120⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        121⤵
        
        PID:772
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        122⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        122⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        119⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        120⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        121⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        122⤵
        
        PID:3332
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        123⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        123⤵
        Modifies registry key
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        120⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        121⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        122⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        123⤵
        
        PID:888
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        124⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        124⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        121⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        122⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        123⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        124⤵
        
        PID:3556
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        125⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        125⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        122⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        123⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        124⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        125⤵
        
        PID:5084
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        126⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        126⤵
        Modifies registry key
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        123⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        124⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        125⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        126⤵
        
        PID:1768
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        127⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        127⤵
        Modifies registry key
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        124⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        125⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        126⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        127⤵
        
        PID:864
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        128⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        128⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        125⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        126⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        127⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        128⤵
        
        PID:872
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        129⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        129⤵
        Modifies registry key
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        126⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        127⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        128⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        129⤵
        
        PID:3296
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        130⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        130⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        127⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        128⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        129⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        130⤵
        
        PID:3100
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        131⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        131⤵
        Modifies registry key
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        128⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        129⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        130⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        131⤵
        
        PID:4692
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        132⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        132⤵
        Modifies registry key
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        129⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        130⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        131⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        132⤵
        
        PID:4672
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        133⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        133⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        130⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        131⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        132⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        133⤵
        
        PID:5932
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        134⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        134⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        131⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        132⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        133⤵
        
        PID:656
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        134⤵
        
        PID:2964
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        135⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        135⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        132⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        133⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        134⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        135⤵
        
        PID:4112
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        136⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        136⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        133⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        134⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        135⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        136⤵
        
        PID:3248
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        137⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        137⤵
        Modifies registry key
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        134⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        135⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        136⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        137⤵
        
        PID:2588
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        138⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        138⤵
        Modifies registry key
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        135⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        136⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        137⤵
        
        PID:528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        138⤵
        
        PID:3264
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        139⤵
        
        PID:500
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        139⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        136⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        137⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        138⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        139⤵
        
        PID:5292
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        140⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        140⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        137⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        138⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        139⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        140⤵
        
        PID:5812
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        141⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        141⤵
        Modifies registry key
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        138⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        139⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        140⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        141⤵
        
        PID:6024
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        142⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        142⤵
        Modifies registry key
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        139⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        140⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        141⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        142⤵
        
        PID:4776
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        143⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        143⤵
        Modifies registry key
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        140⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        141⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        142⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        143⤵
        
        PID:4544
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        144⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        144⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        141⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        142⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        143⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        144⤵
        
        PID:5856
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        145⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        145⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        142⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        143⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        144⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        145⤵
        
        PID:1660
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        146⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        146⤵
        Modifies registry key
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        143⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        144⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        145⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        146⤵
        
        PID:1856
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        147⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        147⤵
        Modifies registry key
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        144⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        145⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        146⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        147⤵
        
        PID:3988
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        148⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        148⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        145⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        146⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        147⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        148⤵
        
        PID:3304
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        149⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        149⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        146⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        147⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        148⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        149⤵
        
        PID:4956
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        150⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        150⤵
        Modifies registry key
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        147⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        148⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        149⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        150⤵
        
        PID:5340
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        151⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        151⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        148⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        149⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        150⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        151⤵
        
        PID:2704
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        152⤵
        
        PID:216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        152⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        149⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        150⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        151⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        152⤵
        
        PID:3284
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        153⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        153⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        150⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        151⤵
        
        PID:644
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        152⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        153⤵
        
        PID:5100
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        154⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        154⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        151⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        152⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        153⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        154⤵
        
        PID:5196
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        155⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        155⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        152⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        153⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        154⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        155⤵
        
        PID:3952
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        156⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        153⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        154⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        155⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        156⤵
        
        PID:1304
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        157⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        154⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        155⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        156⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        157⤵
        
        PID:6140
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        158⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        155⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        156⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        157⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        158⤵
        
        PID:1400
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        159⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        156⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        157⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        158⤵
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        159⤵
        
        PID:5844
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        160⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        157⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        158⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        159⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        160⤵
        
        PID:5060
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        161⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        158⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        159⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        160⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        161⤵
        
        PID:3984
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        162⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        159⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        160⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        161⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        162⤵
        
        PID:3620
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        163⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        160⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        161⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        162⤵
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        163⤵
        
        PID:2008
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        164⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        161⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        162⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        163⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        164⤵
        
        PID:4700
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        165⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        162⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        163⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        164⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        165⤵
        
        PID:5976
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        166⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        163⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        164⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        165⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        166⤵
        
        PID:2412
        
        C:\intodll\agentSaves.exe
        
        "C:\intodll\agentSaves.exe"
        167⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        164⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        165⤵
        
        PID:496
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        166⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\intodll\SNnEeg5Q2Cv9CjuPi.bat" "
        167⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        165⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        166⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        167⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        166⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        167⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        168⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        167⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        168⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        169⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        168⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        169⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        170⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        169⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Wave.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
        170⤵
        
        PID:864
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe"
        171⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Electron.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
        170⤵
        
        PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\wscript.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\PackageManifests\wscript.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3104 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:5532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Electron.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Electron.exe.log
Size 847B
SHA256 f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
MD5 66a0a4aa01208ed3d53a5e131a8d030a
SHA1 ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA512 626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
MD5 SHA1 SHA512

Submit Download

agentSaves.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\agentSaves.exe.log
Size 1KB
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
MD5 SHA1 SHA512

Submit Download

4kaJnY8jMt.bat

Path C:\Users\Admin\AppData\Local\Temp\4kaJnY8jMt.bat
Size 194B
SHA256 74c525dc7559bf0d66d7a28930f01443170d2670e14ce97979595df2e688c015
MD5 737afa7ba0067d725e1c132704c7e827
SHA1 7956690da64b9e13d01ae828cfb3f79eb1187dba
SHA512 adab8d45e6829a099c51c297dce3dc574c3895f5ee3a8c72964cdf6f738f866b92bde7cdc8d9b3345d3c3fe6439e94730125ea8087b726cc8400fb7004a1ac04
MD5 SHA1 SHA512

Submit Download

Wave.exe

Path C:\Users\Admin\AppData\Local\Temp\Wave.exe
Size 1.1MB
SHA256 b93a75b91fc959841d58f93830d4759f52e48ad15c16af9a18dd4d015623427f
MD5 685ff3fd7d167e37b45bda7c65fe191e
SHA1 b01fd735f75f2ac70fe78c30488cc19c0730378a
SHA512 ae1389e64b5bf4ca6ced8a6ac1e17878684cd84ca8f342d8b3d2880129397d330838761c28e14327784fa627cedd1145036840af38dfe113e28208673d40a8b2
SSDEEP 24576:u2G/nvxW3WieC2EtY9mG+9mZX0boWdN2g:ubA3j2o0+9mZqb
MD5 SHA1 SHA512 SSDEEP

Submit Download

SNnEeg5Q2Cv9CjuPi.bat

Path C:\intodll\SNnEeg5Q2Cv9CjuPi.bat
Size 139B
SHA256 2c3da80e897eeac43a7af3256ff0d7ace9f47409eb807d3ea927386a18bb50b0
MD5 3bcbf28bfcd7d6834260c1bfe587f748
SHA1 5903cf4f9af2c0fb7758d610cf55fca400681f31
SHA512 1f3c27dfe1c4207a8e504e1e9fe05a00e411bf9391725d9606b189135d52896c6116d514ff339f1f825a27c283b19103725d8ada7ec3bd7337dd8ab8d1d004c4
MD5 SHA1 SHA512

Submit Download

agentSaves.exe

Path C:\intodll\agentSaves.exe
Size 828KB
SHA256 0829cf36a0c20e61d3b17d7567285d8c781956f11bcf5dfdf01bf7eec55639ee
MD5 8ee83bf5811c7d6dfc440def46698e1b
SHA1 ba308e644aa6da9c49b30cde55250bd21b46311d
SHA512 3b85bb9588e00962a3c6b7943682ea854dd07eb147328613a76ee12495182f293f8c9ca4e893a35998257308404d312dddeff5a2eb233f76d7360f86c0d9c61b
SSDEEP 12288:qHktfU409mG/tA9gw2Ognm5iWZszcghOk/0bowNzxwQP2:qEtY9mG+9mZX0boWdN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe

Path C:\intodll\y0LpePQk9XshIjFowHv2wkKGa7UJ.vbe
Size 201B
SHA256 05293f26bbcaf3bcc4047490be599c8e3663cf06be1422651ea2a42291cf6218
MD5 f1f4878ad9b863a501dc67c5abf778d8
SHA1 4e4bc06616ac50f2a213cb110db76a48726d1f8d
SHA512 a84fcfa4947c52531a9ae500e81ef69bed6fabb714190e9328e328bec23ca9b30c562d565aaccd3085ca086ae0814802ed54634c51bccbc6d5b84d3c8a75fb2c
MD5 SHA1 SHA512

Submit Download

memory/1952-13-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/1952-14-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/1952-16-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/3544-0-0x00007FFD84573000-0x00007FFD84575000-memory.dmp

Download

memory/3544-2-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/3544-1-0x0000000000620000-0x0000000000638000-memory.dmp

Download

memory/3544-106-0x00007FFD84570000-0x00007FFD85031000-memory.dmp

Download

memory/5904-40-0x0000000000190000-0x0000000000266000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads