4c9f343c4a2278d2ae59e374ee75c58109e1c4b8f6c3ebf481b496811ca1a7f8

Analysis

max time kernel
34s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
Size

100KB
MD5

2d9e9be24371572f16ffb9ed1d3bb777
SHA1

6f440788a0fd1927812c7d59a3cb4344d64d6777
SHA256

4c9f343c4a2278d2ae59e374ee75c58109e1c4b8f6c3ebf481b496811ca1a7f8
SHA512

9b11baf53d8420a41e03ec1c90e16970ac6affeb558a919ee30e7a68d809346c972862c813ed8fb67c89e9e1082558eaa099fc230ba0ab74816401e72ccf3cb6
SSDEEP

1536:Z331xdLa+ku3U+f+tzTdK0h+0l6enPRkvGQVgIE:ZnZL3ksjfKcNOLIE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\ProgramData\\application data\\Microsoft\\Keyboard\\kbdsys.exe\""	winzip.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winzip.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winzip.exe

Executes dropped EXE 64 IoCs

pid	Process
1864	winzip.exe
1128	2.exe
2424	winnthlp1.exe
3052	winnthlp2.exe
1860	lsass.exe
2776	2.exe
2724	winnthlp2.exe
2772	2.exe
1752	2.exe
2672	winnthlp1.exe
2984	2.exe
2944	winnthlp2.exe
2804	2.exe
2540	winnthlp1.exe
2500	2.exe
2548	winnthlp2.exe
892	2.exe
2780	winnthlp1.exe
1764	2.exe
1676	winnthlp2.exe
2580	2.exe
2652	winnthlp1.exe
2232	2.exe
2560	winnthlp2.exe
2840	2.exe
2052	winnthlp1.exe
2200	2.exe
2256	winnthlp2.exe
2560	2.exe
1676	2.exe
2200	winnthlp2.exe
636	winnthlp1.exe
2744	2.exe
2584	winnthlp1.exe
532	2.exe
1788	winnthlp2.exe
1688	2.exe
2416	2.exe
1852	winnthlp1.exe
2804	winnthlp2.exe
304	2.exe
1292	winnthlp1.exe
1688	2.exe
532	winnthlp2.exe
620	2.exe
2680	winnthlp1.exe
2552	2.exe
1868	winnthlp2.exe
3148	2.exe
3200	winnthlp1.exe
3268	winnthlp2.exe
3896	2.exe
3940	winnthlp1.exe
4004	winnthlp2.exe
3632	2.exe
3676	winnthlp1.exe
3420	winnthlp2.exe
2964	2.exe
4092	winnthlp1.exe
3944	2.exe
3556	winnthlp2.exe
4044	2.exe
3656	winnthlp1.exe
4084	2.exe

Loads dropped DLL 64 IoCs

pid	Process
2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
1864	winzip.exe
1864	winzip.exe
1128	2.exe
1128	2.exe
1128	2.exe
1128	2.exe
1864	winzip.exe
1864	winzip.exe
2776	2.exe
2776	2.exe
1860	lsass.exe
1860	lsass.exe
1864	winzip.exe
1864	winzip.exe
1752	2.exe
1752	2.exe
1860	lsass.exe
1860	lsass.exe
2984	2.exe
2984	2.exe
1864	winzip.exe
1864	winzip.exe
2804	2.exe
2804	2.exe
1860	lsass.exe
1860	lsass.exe
2500	2.exe
2500	2.exe
1864	winzip.exe
1864	winzip.exe
892	2.exe
892	2.exe
1860	lsass.exe
1860	lsass.exe
1764	2.exe
1764	2.exe
1864	winzip.exe
1864	winzip.exe
2580	2.exe
2580	2.exe
1860	lsass.exe
1860	lsass.exe
2580	2.exe
2580	2.exe
1864	winzip.exe
1864	winzip.exe
2840	2.exe
2840	2.exe
1860	lsass.exe
1860	lsass.exe
2200	2.exe
2200	2.exe
1864	winzip.exe
1864	winzip.exe
1860	lsass.exe
1860	lsass.exe
2560	2.exe
2560	2.exe
1676	2.exe
1676	2.exe
1864	winzip.exe
1864	winzip.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinSys = "C:\\Windows\\system.exe"	winzip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DirLocker = "C:\\ProgramData\\application data\\www.zilch·infinisoft.biz.de\\winzip.exe"	winzip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LSAShell = "C:\\Windows\\lsass.exe"	winzip.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	winzip.exe
File opened (read-only)	\??\M:	winzip.exe
File opened (read-only)	\??\O:	winzip.exe
File opened (read-only)	\??\P:	winzip.exe
File opened (read-only)	\??\I:	winzip.exe
File opened (read-only)	\??\K:	winzip.exe
File opened (read-only)	\??\Q:	winzip.exe
File opened (read-only)	\??\R:	winzip.exe
File opened (read-only)	\??\U:	winzip.exe
File opened (read-only)	\??\Y:	winzip.exe
File opened (read-only)	\??\Z:	winzip.exe
File opened (read-only)	\??\J:	winzip.exe
File opened (read-only)	\??\L:	winzip.exe
File opened (read-only)	\??\T:	winzip.exe
File opened (read-only)	\??\V:	winzip.exe
File opened (read-only)	\??\X:	winzip.exe
File opened (read-only)	\??\G:	winzip.exe
File opened (read-only)	\??\H:	winzip.exe
File opened (read-only)	\??\N:	winzip.exe
File opened (read-only)	\??\S:	winzip.exe
File opened (read-only)	\??\W:	winzip.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	winzip.exe
File created	C:\autorun.inf	winzip.exe
File opened for modification	F:\autorun.inf	winzip.exe
File created	F:\autorun.inf	winzip.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\0407	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\es-ES.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\hr-HR.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\lt-LT	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\sr-Latn-CS.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers	winnthlp2.exe
File created	C:\Windows\SysWOW64\fr.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\migration.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\en	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\pl-PL.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp2.exe	winzip.exe
File opened for modification	C:\Windows\SysWOW64\es-ES	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\pt-PT	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml	winnthlp1.exe
File created	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\catroot2.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\MUI.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File created	C:\Windows\SysWOW64\ro-RO.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\sl-SI	winnthlp2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\it	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\nb-NO	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\zh-CN	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\0407	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\wdi	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\0411.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\config	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\de.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\ras	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\wbem.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp2.exe
File created	C:\Windows\SysWOW64\DriverStore.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\da-DK.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\hr-HR	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\oobe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp2.exe	2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\MSBuild.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Defender	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Mail	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Do not open - secrets!.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Mail.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\MSBuild.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Do not open - secrets!.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Defender.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\MSBuild	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Portable Devices.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Boot.exe	winnthlp2.exe
File opened for modification	C:\Windows\rescache.exe	winnthlp2.exe
File opened for modification	C:\Windows\en-US.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\rescache	winnthlp1.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp2.exe
File created	C:\Windows\debug.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\system.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp1.exe
File opened for modification	C:\Windows\diagnostics.exe	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics	winnthlp2.exe
File created	C:\Windows\PCHEALTH.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics.exe	winnthlp1.exe
File created	C:\Windows\RemotePackages.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\rescache.exe	winnthlp2.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics	winnthlp1.exe
File opened for modification	C:\Windows\diagnostics	winnthlp2.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp1.exe
File created	C:\Windows\diagnostics.exe	winnthlp1.exe
File created	C:\Windows\rescache.exe	winnthlp1.exe
File opened for modification	C:\Windows\winsxs.exe	winnthlp2.exe
File created	C:\Windows\rescache.exe	winnthlp1.exe
File opened for modification	C:\Windows\System32.exe	winnthlp2.exe
File created	C:\Windows\diagnostics.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Offline Web Pages	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp2.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\rescache	winnthlp2.exe
File opened for modification	C:\Windows\system.exe	winnthlp1.exe
File opened for modification	C:\Windows\winsxs	winnthlp2.exe
File created	C:\Windows\Boot.exe	winnthlp2.exe
File created	C:\Windows\servicing.exe	winnthlp2.exe
File opened for modification	C:\Windows\winsxs	winnthlp2.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp1.exe
File opened for modification	C:\Windows\Boot	winnthlp1.exe
File opened for modification	C:\Windows\ja-JP	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File created	C:\Windows\System32.exe	winnthlp1.exe
File created	C:\Windows\rescache.exe	winnthlp1.exe
File opened for modification	C:\Windows\system.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp1.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\Boot	winnthlp1.exe
File opened for modification	C:\Windows\System32.exe	winnthlp1.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp1.exe
File opened for modification	C:\Windows\System32.exe	winnthlp1.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp1.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp2.exe
File opened for modification	C:\Windows\Migration	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Panther.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\Boot.exe	winnthlp1.exe
File created	C:\Windows\System32.exe	winnthlp2.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp2.exe
File created	C:\Windows\diagnostics.exe	winnthlp1.exe
File created	C:\Windows\rescache.exe	winnthlp2.exe
File opened for modification	C:\Windows\Boot	winnthlp1.exe
File opened for modification	C:\Windows\winsxs.exe	winnthlp2.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
8164	7360	WerFault.exe	471
7552	8040	WerFault.exe	510

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\NodeSlot = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2916	vssvc.exe
Token: SeRestorePrivilege	2916	vssvc.exe
Token: SeAuditPrivilege	2916	vssvc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
1864	winzip.exe
1128	2.exe
2424	winnthlp1.exe
3052	winnthlp2.exe
1860	lsass.exe
2776	2.exe
2724	winnthlp2.exe
2772	2.exe
1752	2.exe
2672	winnthlp1.exe
2984	2.exe
2944	winnthlp2.exe
2804	2.exe
2540	winnthlp1.exe
2500	2.exe
2548	winnthlp2.exe
892	2.exe
2780	winnthlp1.exe
1764	2.exe
1676	winnthlp2.exe
2580	2.exe
2652	winnthlp1.exe
2232	2.exe
2560	winnthlp2.exe
2840	2.exe
2052	winnthlp1.exe
2200	2.exe
2256	winnthlp2.exe
2560	2.exe
1676	2.exe
2200	winnthlp2.exe
636	winnthlp1.exe
2744	2.exe
2584	winnthlp1.exe
532	2.exe
1788	winnthlp2.exe
1688	2.exe
1852	winnthlp1.exe
2416	2.exe
2804	winnthlp2.exe
304	2.exe
1292	winnthlp1.exe
1688	2.exe
532	winnthlp2.exe
620	2.exe
2680	winnthlp1.exe
2552	2.exe
1868	winnthlp2.exe
3148	2.exe
3200	winnthlp1.exe
3268	winnthlp2.exe
3896	2.exe
3940	winnthlp1.exe
4004	winnthlp2.exe
3632	2.exe
3676	winnthlp1.exe
3420	winnthlp2.exe
2964	2.exe
4092	winnthlp1.exe
3556	winnthlp2.exe
3944	2.exe
4044	2.exe
3656	winnthlp1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2232	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	29
PID 2028 wrote to memory of 2232	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	29
PID 2028 wrote to memory of 2232	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	29
PID 2028 wrote to memory of 2232	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	29
PID 2028 wrote to memory of 1864	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	31
PID 2028 wrote to memory of 1864	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	31
PID 2028 wrote to memory of 1864	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	31
PID 2028 wrote to memory of 1864	2028	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	31
PID 1864 wrote to memory of 1128	1864	winzip.exe	32
PID 1864 wrote to memory of 1128	1864	winzip.exe	32
PID 1864 wrote to memory of 1128	1864	winzip.exe	32
PID 1864 wrote to memory of 1128	1864	winzip.exe	32
PID 1128 wrote to memory of 2424	1128	2.exe	33
PID 1128 wrote to memory of 2424	1128	2.exe	33
PID 1128 wrote to memory of 2424	1128	2.exe	33
PID 1128 wrote to memory of 2424	1128	2.exe	33
PID 1128 wrote to memory of 3052	1128	2.exe	34
PID 1128 wrote to memory of 3052	1128	2.exe	34
PID 1128 wrote to memory of 3052	1128	2.exe	34
PID 1128 wrote to memory of 3052	1128	2.exe	34
PID 2424 wrote to memory of 324	2424	winnthlp1.exe	35
PID 2424 wrote to memory of 324	2424	winnthlp1.exe	35
PID 2424 wrote to memory of 324	2424	winnthlp1.exe	35
PID 2424 wrote to memory of 324	2424	winnthlp1.exe	35
PID 3052 wrote to memory of 1640	3052	winnthlp2.exe	36
PID 3052 wrote to memory of 1640	3052	winnthlp2.exe	36
PID 3052 wrote to memory of 1640	3052	winnthlp2.exe	36
PID 3052 wrote to memory of 1640	3052	winnthlp2.exe	36
PID 2424 wrote to memory of 1860	2424	winnthlp1.exe	37
PID 2424 wrote to memory of 1860	2424	winnthlp1.exe	37
PID 2424 wrote to memory of 1860	2424	winnthlp1.exe	37
PID 2424 wrote to memory of 1860	2424	winnthlp1.exe	37
PID 1864 wrote to memory of 2776	1864	winzip.exe	73
PID 1864 wrote to memory of 2776	1864	winzip.exe	73
PID 1864 wrote to memory of 2776	1864	winzip.exe	73
PID 1864 wrote to memory of 2776	1864	winzip.exe	73
PID 2776 wrote to memory of 2724	2776	2.exe	44
PID 2776 wrote to memory of 2724	2776	2.exe	44
PID 2776 wrote to memory of 2724	2776	2.exe	44
PID 2776 wrote to memory of 2724	2776	2.exe	44
PID 1860 wrote to memory of 2772	1860	lsass.exe	45
PID 1860 wrote to memory of 2772	1860	lsass.exe	45
PID 1860 wrote to memory of 2772	1860	lsass.exe	45
PID 1860 wrote to memory of 2772	1860	lsass.exe	45
PID 2724 wrote to memory of 2788	2724	winnthlp2.exe	46
PID 2724 wrote to memory of 2788	2724	winnthlp2.exe	46
PID 2724 wrote to memory of 2788	2724	winnthlp2.exe	46
PID 2724 wrote to memory of 2788	2724	winnthlp2.exe	46
PID 1864 wrote to memory of 1752	1864	winzip.exe	49
PID 1864 wrote to memory of 1752	1864	winzip.exe	49
PID 1864 wrote to memory of 1752	1864	winzip.exe	49
PID 1864 wrote to memory of 1752	1864	winzip.exe	49
PID 1752 wrote to memory of 2672	1752	2.exe	71
PID 1752 wrote to memory of 2672	1752	2.exe	71
PID 1752 wrote to memory of 2672	1752	2.exe	71
PID 1752 wrote to memory of 2672	1752	2.exe	71
PID 1860 wrote to memory of 2984	1860	lsass.exe	51
PID 1860 wrote to memory of 2984	1860	lsass.exe	51
PID 1860 wrote to memory of 2984	1860	lsass.exe	51
PID 1860 wrote to memory of 2984	1860	lsass.exe	51
PID 2984 wrote to memory of 2944	2984	2.exe	52
PID 2984 wrote to memory of 2944	2984	2.exe	52
PID 2984 wrote to memory of 2944	2984	2.exe	52
PID 2984 wrote to memory of 2944	2984	2.exe	52

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_jaffacakes118
  2⤵
  PID:2232
- C:\ProgramData\application data\www.zilch·infinisoft.biz.de\winzip.exe
  "C:\ProgramData\application data\www.zilch·infinisoft.biz.de\winzip.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Users\Admin\AppData\Local\Temp\mpuleu-mlvaiu-h7nxzz-55fjob-ouz3qs\2.exe
    C:\Users\Admin\AppData\Local\Temp\mpuleu-mlvaiu-h7nxzz-55fjob-ouz3qs\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:324
    - - C:\Windows\lsass.exe
        
        C:\Windows\lsass.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\fgwk4n-fcx98o-byoxps-yxhie4-il03gl\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\fgwk4n-fcx98o-byoxps-yxhie4-il03gl\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\zoadpf-6emuc8-w2ryli-qtudso-3jsemb\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\zoadpf-6emuc8-w2ryli-qtudso-3jsemb\2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2944
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\mtmlcw-nkbjqw-k1rgiz-8u8bhb-2rngdh\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\mtmlcw-nkbjqw-k1rgiz-8u8bhb-2rngdh\2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2548
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\pwgc27-xgg3yz-xchs2z-sz9fj4-gx118g\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\pwgc27-xgg3yz-xchs2z-sz9fj4-gx118g\2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\00xy5i-2lb5ug-9bmnga-yysrqk-tqv5wq\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\00xy5i-2lb5ug-9bmnga-yysrqk-tqv5wq\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\ij626x-ryu2cp-rpk0ro-xk683i-mdn32t\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ij626x-ryu2cp-rpk0ro-xk683i-mdn32t\2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\pddrz1-rtf8yy-9smafh-z9gnyr-4aem0l\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\pddrz1-rtf8yy-9smafh-z9gnyr-4aem0l\2.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2200
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\kmt3ua-3adovr-eax65g-l08or9-bnes0k\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\kmt3ua-3adovr-eax65g-l08or9-bnes0k\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:1788
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\ouchpx-2j9ijk-kc4ua2-l3tso1-rzg00v\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ouchpx-2j9ijk-kc4ua2-l3tso1-rzg00v\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\je5siw-3xdmtc-fsmed0-ncm49s-n8ntes\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\je5siw-3xdmtc-fsmed0-ncm49s-n8ntes\2.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1688
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:532
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\d8l1ov-06end7-kux7eo-lfbf3m-s5nwpf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\d8l1ov-06end7-kux7eo-lfbf3m-s5nwpf\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\9irzg0-4auen6-hzsfht-zsnq8a-0jcon9\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\9irzg0-4auen6-hzsfht-zsnq8a-0jcon9\2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3148
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3268
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\xay95x-m2f349-f0t91f-ru20k3-zf2rhv\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\xay95x-m2f349-f0t91f-ru20k3-zf2rhv\2.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\bcvj37-7yn6kc-li9hoy-elyca5-f6ckz3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\bcvj37-7yn6kc-li9hoy-elyca5-f6ckz3\2.exe
        6⤵
        Executes dropped EXE
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\egi3o0-33o7xb-yvrl4g-bkpmy3-tdkypl\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\egi3o0-33o7xb-yvrl4g-bkpmy3-tdkypl\2.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\byy633-hulefx-6m29e9-q5a3qp-20juad\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\byy633-hulefx-6m29e9-q5a3qp-20juad\2.exe
        6⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        Drops file in Windows directory
        
        PID:3664
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Drops file in Windows directory
        
        PID:660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\v7i2m7-lpcg5h-qqaf7c-49wpby-nxgadf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\v7i2m7-lpcg5h-qqaf7c-49wpby-nxgadf\2.exe
        6⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Drops file in Windows directory
        
        PID:4584
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\6b0j9o-d1b0vi-2oh44s-xgkjby-a5ik5l\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\6b0j9o-d1b0vi-2oh44s-xgkjby-a5ik5l\2.exe
        6⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        Drops file in Windows directory
        
        PID:4856
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4184
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\b0f2bx-br40pw-hnq81q-w11rgc-qygxci\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\b0f2bx-br40pw-hnq81q-w11rgc-qygxci\2.exe
        6⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4868
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:304
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\1lcshu-95cidm-91d7hm-4o5vyr-smxgn3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\1lcshu-95cidm-91d7hm-4o5vyr-smxgn3\2.exe
        6⤵
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        Drops file in Windows directory
        
        PID:4496
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\vse24s-xds9sq-433rfj-35f68k-yxilfp\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\vse24s-xds9sq-433rfj-35f68k-yxilfp\2.exe
        6⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\hrt0ob-0lobgs-0cd9us-xtu6lv-lmb1k7\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\hrt0ob-0lobgs-0cd9us-xtu6lv-lmb1k7\2.exe
        6⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\ioak1j-k4c00h-23i2hz-1zjrlz-xlbf24\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ioak1j-k4c00h-23i2hz-1zjrlz-xlbf24\2.exe
        6⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\8ujn0g-0x9imn-2inqbl-98z7xe-yw4b6p\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8ujn0g-0x9imn-2inqbl-98z7xe-yw4b6p\2.exe
        6⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\wsuyel-9hrz88-ramazq-s1b8ep-yxygqj\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\wsuyel-9hrz88-ramazq-s1b8ep-yxygqj\2.exe
        6⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\r0dzb7-bjltnn-oduk7b-vyub33-vuv073\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\r0dzb7-bjltnn-oduk7b-vyub33-vuv073\2.exe
        6⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\k3g12p-819mq1-rqs7si-2qcp17-9go7o0\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\k3g12p-819mq1-rqs7si-2qcp17-9go7o0\2.exe
        6⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\01uok5-vtx2rb-8iv3lx-qbqfcf-r2fdre\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\01uok5-vtx2rb-8iv3lx-qbqfcf-r2fdre\2.exe
        6⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\nahz16-b3yt0h-50czwn-hvlqgb-pflhc3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\nahz16-b3yt0h-50czwn-hvlqgb-pflhc3\2.exe
        6⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\1x0cxt-wkszey-kikl3a-36465r-5sidtp\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\1x0cxt-wkszey-kikl3a-36465r-5sidtp\2.exe
        6⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\zppr2k-pcuvbu-j4xai0-671mxd-fmqm34\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\zppr2k-pcuvbu-j4xai0-671mxd-fmqm34\2.exe
        6⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\90au4w-fvx3fq-3oexf1-xls2b7-01vja5\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\90au4w-fvx3fq-3oexf1-xls2b7-01vja5\2.exe
        6⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\vuocce-lbjqvo-qchpxi-4w3z14-oknj3l\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\vuocce-lbjqvo-qchpxi-4w3z14-oknj3l\2.exe
        6⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\ahuusl-h75cef-6ubgnp-1meuuv-ebcvoi\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ahuusl-h75cef-6ubgnp-1meuuv-ebcvoi\2.exe
        6⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\v202we-wtp0ad-2oc8m7-qht3lj-b01xxz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\v202we-wtp0ad-2oc8m7-qht3lj-b01xxz\2.exe
        6⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\v6avis-3qamfk-3naajk-y92y0o-m7vkp1\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\v6avis-3qamfk-3naajk-y92y0o-m7vkp1\2.exe
        6⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\w6ty3z-yr75sx-5himeq-4ju28r-ybygfx\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\w6ty3z-yr75sx-5himeq-4ju28r-ybygfx\2.exe
        6⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\f3g8gk-xxbj82-yn0hm1-v4hed5-jxy9cg\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\f3g8gk-xxbj82-yn0hm1-v4hed5-jxy9cg\2.exe
        6⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\urnb3e-6mw3n2-e6wtju-d3xiou-9pp65z\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\urnb3e-6mw3n2-e6wtju-d3xiou-9pp65z\2.exe
        6⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        8⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\xgojmr-qjde8y-r4rmxx-yu33jq-nh87s0\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\xgojmr-qjde8y-r4rmxx-yu33jq-nh87s0\2.exe
        6⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\h3krun-vsisoa-dld4fr-ec22tq-k8pa5k\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\h3krun-vsisoa-dld4fr-ec22tq-k8pa5k\2.exe
        6⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\7cdxmx-rvlryd-4puii1-lp0kzj-b6vyit\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\7cdxmx-rvlryd-4puii1-lp0kzj-b6vyit\2.exe
        6⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\6mvul4-k6h4pq-3u0pr7-euk70w-lkwpnp\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\6mvul4-k6h4pq-3u0pr7-euk70w-lkwpnp\2.exe
        6⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\a4vode-4wy3jk-hlw4d6-0fqf5o-06gdjn\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\a4vode-4wy3jk-hlw4d6-0fqf5o-06gdjn\2.exe
        6⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\tx0z8y-8bbimk-29pnjq-e3yf2e-moy6z6\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tx0z8y-8bbimk-29pnjq-e3yf2e-moy6z6\2.exe
        6⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\4m2yqb-08tm7g-n6m8ws-7u5sy9-8gjzm7\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\4m2yqb-08tm7g-n6m8ws-7u5sy9-8gjzm7\2.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\d154x8-c2hjr9-7ukyye-kjhzs1-2dcaji\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\d154x8-c2hjr9-7ukyye-kjhzs1-2dcaji\2.exe
        6⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        8⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\dochxe-95seoi-xy99nt-rvoekz-ubquix\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\dochxe-95seoi-xy99nt-rvoekz-ubquix\2.exe
        6⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8040 -s 396
        8⤵
        Program crash
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\1ktzef-1gunif-w3mbzk-am8l36-3pyhpd\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\1ktzef-1gunif-w3mbzk-am8l36-3pyhpd\2.exe
        6⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\5b6le5-c1h30y-2on799-wgqlge-95nna1\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\5b6le5-c1h30y-2on799-wgqlge-95nna1\2.exe
        6⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\jii5wj-j973ai-p4ucmc-exb6lo-yfj0x3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\jii5wj-j973ai-p4ucmc-exb6lo-yfj0x3\2.exe
        6⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\mtjeuy-uek5qq-uakuvq-qwcicv-du4307\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\mtjeuy-uek5qq-uakuvq-qwcicv-du4307\2.exe
        6⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\scsjsh-3cc216-a2ojnz-0qtnx9-uhw24f\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\scsjsh-3cc216-a2ojnz-0qtnx9-uhw24f\2.exe
        6⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\gr8kgj-yl3w71-zcsum0-ws9qd4-klqlcf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\gr8kgj-yl3w71-zcsum0-ws9qd4-klqlcf\2.exe
        6⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\hhiv3b-tbrnnz-1wrejr-1sr2or-xfjq5v\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\hhiv3b-tbrnnz-1wrejr-1sr2or-xfjq5v\2.exe
        6⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\bwbjo8-uku4qp-w68ben-3wkt0g-sjqxar\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\bwbjo8-uku4qp-w68ben-3wkt0g-sjqxar\2.exe
        6⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\sk2lj5-fn6xxi-o2ux49-otkvi9-up63u3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\sk2lj5-fn6xxi-o2ux49-otkvi9-up63u3\2.exe
        6⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\a2keyj-3zzjvp-6f10un-ne72b5-ew2fuf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\a2keyj-3zzjvp-6f10un-ne72b5-ew2fuf\2.exe
        6⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\ljm6tw-z38gxi-jrs1zy-urcj8n-1hn1ug\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ljm6tw-z38gxi-jrs1zy-urcj8n-1hn1ug\2.exe
        6⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\h94122-c17f98-pq4g2u-7kzruc-8app8b\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\h94122-c17f98-pq4g2u-7kzruc-8app8b\2.exe
        6⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\ebgs7m-34xn6x-nn6hid-zhe921-72e0yt\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ebgs7m-34xn6x-nn6hid-zhe921-72e0yt\2.exe
        6⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\ecdl8u-9y58py-xwxuea-gkhefr-i6vm4q\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ecdl8u-9y58py-xwxuea-gkhefr-i6vm4q\2.exe
        6⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\8pcnvt-7ro2pu-2jrgwz-f8phqm-x2kth4\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8pcnvt-7ro2pu-2jrgwz-f8phqm-x2kth4\2.exe
        6⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\795d98-4qla1b-sj250n-mghawt-yap2gh\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\795d98-4qla1b-sj250n-mghawt-yap2gh\2.exe
        6⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\fjkry3-fflg23-a1d3j8-olzdnu-hop991\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\fjkry3-fflg23-a1d3j8-olzdnu-hop991\2.exe
        6⤵
        
        PID:940
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\uqcsr9-1gn9e2-r3tend-lvwsui-ykttn5\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\uqcsr9-1gn9e2-r3tend-lvwsui-ykttn5\2.exe
        6⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\uayf3w-v0odhv-1waltp-pprgs1-a70a4g\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\uayf3w-v0odhv-1waltp-pprgs1-a70a4g\2.exe
        6⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\ou26mi-5t8830-wa3lma-1b1ko5-fvnusr\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\ou26mi-5t8830-wa3lma-1b1ko5-fvnusr\2.exe
        6⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\5cmnng-gc65w5-n2iniy-dpnrr9-7hr5ye\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\5cmnng-gc65w5-n2iniy-dpnrr9-7hr5ye\2.exe
        6⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\pzm778-7thjzp-8k6hdp-eftppj-tt3834\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\pzm778-7thjzp-8k6hdp-eftppj-tt3834\2.exe
        6⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\v98hyo-84g9ic-foh0e4-flhoi4-b79cz9\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\v98hyo-84g9ic-foh0e4-flhoi4-b79cz9\2.exe
        6⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\vxaflu-eluznb-g787b9-mxjox2-lzv4r3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\vxaflu-eluznb-g787b9-mxjox2-lzv4r3\2.exe
        6⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\p9mrf2-2yks9p-kse416-lj41f6-h0ky69\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\p9mrf2-2yks9p-kse416-lj41f6-h0ky69\2.exe
        6⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\zhkicg-tezn8n-wu137k-dt85o3-dq8us3\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\zhkicg-tezn8n-wu137k-dt85o3-dq8us3\2.exe
        6⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\rau2br-5tgcfd-xw682k-zikgqi-67vxcc\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rau2br-5tgcfd-xw682k-zikgqi-67vxcc\2.exe
        6⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\i847y5-d07l5a-qp5nyx-8jzyqf-9apw4e\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\i847y5-d07l5a-qp5nyx-8jzyqf-9apw4e\2.exe
        6⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\x28g8m-mvpb7y-6dy5je-i87w22-qs7nzu\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\x28g8m-mvpb7y-6dy5je-i87w22-qs7nzu\2.exe
        6⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\awy5lh-6ipt2l-tgifry-c41zse-o4li23\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\awy5lh-6ipt2l-tgifry-c41zse-o4li23\2.exe
        6⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\3dl85p-t1qcf0-nsurl5-0hrsfs-jbm36a\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\3dl85p-t1qcf0-nsurl5-0hrsfs-jbm36a\2.exe
        6⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\4srs3f-098pvj-p2pkuv-jz3pq1-vuchap\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\4srs3f-098pvj-p2pkuv-jz3pq1-vuchap\2.exe
        6⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\rwa0v7-rtbpz7-mf3dgc-advy5o-t1fj65\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rwa0v7-rtbpz7-mf3dgc-advy5o-t1fj65\2.exe
        6⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\3asu8u-a04cun-zo9g4x-ufdub3-gjg7pg\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\3asu8u-a04cun-zo9g4x-ufdub3-gjg7pg\2.exe
        6⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\zc79xc-03w7cb-6zjfn5-vr0anh-opffjn\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\zc79xc-03w7cb-6zjfn5-vr0anh-opffjn\2.exe
        6⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\a0iw85-rzozpn-ihjc8x-nihbas-113lee\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\a0iw85-rzozpn-ihjc8x-nihbas-113lee\2.exe
        6⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\b8ubsm-m8et1a-typbn3-ilvfxe-ddyt3j\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\b8ubsm-m8et1a-typbn3-ilvfxe-ddyt3j\2.exe
        6⤵
        
        PID:760
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\6epulg-p8k5cy-qza3qx-wuwb2r-knd613\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\6epulg-p8k5cy-qza3qx-wuwb2r-knd613\2.exe
        6⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\eko2fn-rfxuyb-yzxlv3-yvx9z3-uipxg8\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\eko2fn-rfxuyb-yzxlv3-yvx9z3-uipxg8\2.exe
        6⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\77l8z6-qv5t1n-sgj0pl-z6uhce-y86x6f\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\77l8z6-qv5t1n-sgj0pl-z6uhce-y86x6f\2.exe
        6⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\fvkp7z-skiq1m-add1s4-b42z73-7ljwy6\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\fvkp7z-skiq1m-add1s4-b42z73-7ljwy6\2.exe
        6⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\8ew69q-1cbb6w-e6k3qk-lrkumc-lnkiqc\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8ew69q-1cbb6w-e6k3qk-lrkumc-lnkiqc\2.exe
        6⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\4wlcx7-zooq3d-cdmrx0-u7h2ph-vy603h\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\4wlcx7-zooq3d-cdmrx0-u7h2ph-vy603h\2.exe
        6⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\w9h7kw-k2y2j7-4k6wvn-gffneb-yelpvu\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\w9h7kw-k2y2j7-4k6wvn-gffneb-yelpvu\2.exe
        6⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\koon32-ppmm5x-398w9j-mxshb0-yxczko\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\koon32-ppmm5x-398w9j-mxshb0-yxczko\2.exe
        6⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\mn4lbk-cb9plu-62d3r0-jra4ln-2l5gd4\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\mn4lbk-cb9plu-62d3r0-jra4ln-2l5gd4\2.exe
        6⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\6fjdiq-cb6muk-rph585-kmva5b-wh42oz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\6fjdiq-cb6muk-rph585-kmva5b-wh42oz\2.exe
        6⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\xakzl3-w6lop3-stcc67-gr5xvk-zfoix1\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\xakzl3-w6lop3-stcc67-gr5xvk-zfoix1\2.exe
        6⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\12pp42-8r06qv-7tclkw-2lf0q1-fad1ko\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\12pp42-8r06qv-7tclkw-2lf0q1-fad1ko\2.exe
        6⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\x54od0-xwtms0-ud9ij3-i6qdif-c35ifl\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\x54od0-xwtms0-ud9ij3-i6qdif-c35ifl\2.exe
        6⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\mvahqz-4ugj7h-3qh8bh-zd9vsm-dwv6w8\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\mvahqz-4ugj7h-3qh8bh-zd9vsm-dwv6w8\2.exe
        6⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\50iatk-7lwhii-eb7z4b-3zd3dm-yqghkr\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\50iatk-7lwhii-eb7z4b-3zd3dm-yqghkr\2.exe
        6⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\bkm2z0-udhdri-u47b5h-00tjhb-psaegn\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\bkm2z0-udhdri-u47b5h-00tjhb-psaegn\2.exe
        6⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\irluen-ulumyb-26udu3-22u2z3-yompg8\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\irluen-ulumyb-26udu3-22u2z3-yompg8\2.exe
        6⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\jkcf5l-28wz61-e8gigq-lyrz2j-alx4bu\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\jkcf5l-28wz61-e8gigq-lyrz2j-alx4bu\2.exe
        6⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\es4zl5-rh20fs-9bxb79-a2m9l9-7j26cc\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\es4zl5-rh20fs-9bxb79-a2m9l9-7j26cc\2.exe
        6⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\oo8rxl-hmmwur-ugvodf-11vea8-1xw3e8\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\oo8rxl-hmmwur-ugvodf-11vea8-1xw3e8\2.exe
        6⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\duvw3j-1snisw-kg73ud-l2laib-sswr44\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\duvw3j-1snisw-kg73ud-l2laib-sswr44\2.exe
        6⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\48ivf9-z0l9me-m4pm0r-ujem7j-va3kmi\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\48ivf9-z0l9me-m4pm0r-ujem7j-va3kmi\2.exe
        6⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\w2faid-lvw5hp-fsbaev-h8dqds-z7ktub\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\w2faid-lvw5hp-fsbaev-h8dqds-z7ktub\2.exe
        6⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\z2n9o6-43l8p1-in7iun-1br2v4-cbbl5t\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\z2n9o6-43l8p1-in7iun-1br2v4-cbbl5t\2.exe
        6⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\j2k8a1-8pqcjc-3htrqh-g6rsk4-yzm3bm\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\j2k8a1-8pqcjc-3htrqh-g6rsk4-yzm3bm\2.exe
        6⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\d730qm-j3q92g-7w731r-refxd7-39opwv\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\d730qm-j3q92g-7w731r-refxd7-39opwv\2.exe
        6⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\5wyacs-4syzht-0eqnyx-oci8m9-712toq\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\5wyacs-4syzht-0eqnyx-oci8m9-712toq\2.exe
        6⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\tduxea-035e03-z5huu4-txk819-6mi9vw\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tduxea-035e03-z5huu4-txk819-6mi9vw\2.exe
        6⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\fyjsqv-gp9q4u-d6pnvx-1z6iu9-vwlnrf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\fyjsqv-gp9q4u-d6pnvx-1z6iu9-vwlnrf\2.exe
        6⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\jxvi7r-qhv94j-qewy8j-m0olpo-0jawta\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\jxvi7r-qhv94j-qewy8j-m0olpo-0jawta\2.exe
        6⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:760
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\blsi0g-c66ppe-jwh7b7-9jnbki-3bqprn\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\blsi0g-c66ppe-jwh7b7-9jnbki-3bqprn\2.exe
        6⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\cull2n-vogxt4-vf5v84-1as3ky-q39yj9\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\cull2n-vogxt4-vf5v84-1as3ky-q39yj9\2.exe
        6⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\j551ci-vzetv6-cykvdp-3gf8wy-8hd7yt\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\j551ci-vzetv6-cykvdp-3gf8wy-8hd7yt\2.exe
        6⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\zcogwl-j081y2-u0sj7q-1q31uj-qd953u\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\zcogwl-j081y2-u0sj7q-1q31uj-qd953u\2.exe
        6⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\syruuy-5novok-nhj6f2-o884u1-u3vc6v\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\syruuy-5novok-nhj6f2-o884u1-u3vc6v\2.exe
        6⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\er6bwo-8olgtu-kju8ci-s3uz9a-s0unda\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\er6bwo-8olgtu-kju8ci-s3uz9a-s0unda\2.exe
        6⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\nnimw9-amb8km-uautm3-vv80b1-2lkhxu\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\nnimw9-amb8km-uautm3-vv80b1-2lkhxu\2.exe
        6⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\d8dr6q-8zh6cw-loe76i-3i9iy0-49ygcz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\d8dr6q-8zh6cw-loe76i-3i9iy0-49ygcz\2.exe
        6⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\2hlkb3-q92faf-k7hk6l-nnj15i-4mq3m1\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\2hlkb3-q92faf-k7hk6l-nnj15i-4mq3m1\2.exe
        6⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\e14po3-9nwd57-n7in9t-ga8jv0-ivmqkz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\e14po3-9nwd57-n7in9t-ga8jv0-ivmqkz\2.exe
        6⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:760
      - C:\Users\Admin\AppData\Local\Temp\4l6xw4-t8b16f-o0efck-1pcg67-jj7syp\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\4l6xw4-t8b16f-o0efck-1pcg67-jj7syp\2.exe
        6⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\un5sma-0js0y4-ob9vxf-9uhp9v-loqhtj\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\un5sma-0js0y4-ob9vxf-9uhp9v-loqhtj\2.exe
        6⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\lnb9d3-ljbxh3-g63ly8-44v7nk-nsfro1\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\lnb9d3-ljbxh3-g63ly8-44v7nk-nsfro1\2.exe
        6⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:932
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\x1u0z0-4r5hlt-teblv4-o6e019-1vb1vw\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\x1u0z0-4r5hlt-teblv4-o6e019-1vb1vw\2.exe
        6⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\nj0p4f-oapnie-lr6k9i-9kne8t-3h1k50\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\nj0p4f-oapnie-lr6k9i-9kne8t-3h1k50\2.exe
        6⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\rc8n96-zw8e6y-zt93ay-uf0qr3-idtcgf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rc8n96-zw8e6y-zt93ay-uf0qr3-idtcgf\2.exe
        6⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\bffwrb-d1t3ga-kr5l23-9eapcd-46e3ij\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\bffwrb-d1t3ga-kr5l23-9eapcd-46e3ij\2.exe
        6⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\8f7n90-huwnfr-hlllur-nh8u6l-capo5w\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8f7n90-huwnfr-hlllur-nh8u6l-capo5w\2.exe
        6⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\wpbwm4-z5ecl1-g4ke2k-7mfslt-cndrno\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\wpbwm4-z5ecl1-g4ke2k-7mfslt-cndrno\2.exe
        6⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\o18r77-7qrb9o-jqcuic-pgnb46-f3tfdg\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\o18r77-7qrb9o-jqcuic-pgnb46-f3tfdg\2.exe
        6⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:928
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\tqspia-6fpqcx-o9k13f-p09zie-vvw7u8\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\tqspia-6fpqcx-o9k13f-p09zie-vvw7u8\2.exe
        6⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\6hs4m3-q00yxj-2v9qh7-af9hdz-aca5iz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\6hs4m3-q00yxj-2v9qh7-af9hdz-aca5iz\2.exe
        6⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:928
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\m982y0-970nnd-tvk8pu-ugyfes-169x0l\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\m982y0-970nnd-tvk8pu-ugyfes-169x0l\2.exe
        6⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\2zha9k-xrkpfp-aghq9c-sac11u-t12zft\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\2zha9k-xrkpfp-aghq9c-sac11u-t12zft\2.exe
        6⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\jksqq2-8d9lpe-1anqlk-d4wi58-lpw910\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\jksqq2-8d9lpe-1anqlk-d4wi58-lpw910\2.exe
        6⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\8h0ejn-33s20s-hnec4e-aq48ql-bbiffj\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8h0ejn-33s20s-hnec4e-aq48ql-bbiffj\2.exe
        6⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\0286pu-ppebz5-khhp5a-x6eqzx-f091rf\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\0286pu-ppebz5-khhp5a-x6eqzx-f091rf\2.exe
        6⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\8auygs-e5h6sm-2yy1ry-nh6v3e-zbfnn2\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\8auygs-e5h6sm-2yy1ry-nh6v3e-zbfnn2\2.exe
        6⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\g8x8sr-7qslc1-crqkdw-qacvhi-9ywfjy\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\g8x8sr-7qslc1-crqkdw-qacvhi-9ywfjy\2.exe
        6⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\rw4j4h-ymg0qa-o9m4zl-i1pj6q-vqmk0d\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rw4j4h-ymg0qa-o9m4zl-i1pj6q-vqmk0d\2.exe
        6⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:940
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\whbgte-x80e7e-33nmj7-ihy5yt-bfcbuz\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\whbgte-x80e7e-33nmj7-ihy5yt-bfcbuz\2.exe
        6⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\glcmh5-o6cddx-o2c2hx-kp4qy2-7nwbne\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\glcmh5-o6cddx-o2c2hx-kp4qy2-7nwbne\2.exe
        6⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\f4d5vg-hprckf-of2u68-nhe909-i9in7e\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\f4d5vg-hprckf-of2u68-nhe909-i9in7e\2.exe
        6⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\kbybik-24tma1-3viko0-0czhf4-o5gceg\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\kbybik-24tma1-3viko0-0czhf4-o5gceg\2.exe
        6⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\rkkl90-t0n18x-bzt3pg-awustg-6ilfal\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rkkl90-t0n18x-bzt3pg-awustg-6ilfal\2.exe
        6⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:932
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\dbcnng-6e2j9o-8zgqym-fps8kf-4cxctq\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\dbcnng-6e2j9o-8zgqym-fps8kf-4cxctq\2.exe
        6⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\7nozho-kcm0bb-36hc2t-4x6ahs-astitm\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\7nozho-kcm0bb-36hc2t-4x6ahs-astitm\2.exe
        6⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\a6qdq8-upy71o-6j7zlc-e47qh4-e07em4\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\a6qdq8-upy71o-6j7zlc-e47qh4-e07em4\2.exe
        6⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\rng68b-fl8sxn-y9scy4-99cv8t-gzncum\2.exe
        
        C:\Users\Admin\AppData\Local\Temp\rng68b-fl8sxn-y9scy4-99cv8t-gzncum\2.exe
        6⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\winnthlp1.exe
        
        C:\Windows\system32\winnthlp1.exe
        7⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\winnthlp2.exe
        
        C:\Windows\system32\winnthlp2.exe
        7⤵
        
        PID:1628
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1640
- - C:\Users\Admin\AppData\Local\Temp\kz8yod-rpkfa6-hdpkjh-b4syqm-ouqzk9\2.exe
    C:\Users\Admin\AppData\Local\Temp\kz8yod-rpkfa6-hdpkjh-b4syqm-ouqzk9\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2788
- - C:\Users\Admin\AppData\Local\Temp\bzivms-cq7t0s-87oqsv-xz5lr7-rxjqnd\2.exe
    C:\Users\Admin\AppData\Local\Temp\bzivms-cq7t0s-87oqsv-xz5lr7-rxjqnd\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2672
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2312
- - C:\Users\Admin\AppData\Local\Temp\544ah6-do41ey-dl5piy-87wdz3-w5pzof\2.exe
    C:\Users\Admin\AppData\Local\Temp\544ah6-do41ey-dl5piy-87wdz3-w5pzof\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2804
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2540
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1700
- - C:\Users\Admin\AppData\Local\Temp\83cjpw-aoqreu-he280n-617c9y-1targ3\2.exe
    C:\Users\Admin\AppData\Local\Temp\83cjpw-aoqreu-he280n-617c9y-1targ3\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:892
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2672
- - C:\Users\Admin\AppData\Local\Temp\obqfq2-xqffxt-yh4dbs-4drmnm-s68gmy\2.exe
    C:\Users\Admin\AppData\Local\Temp\obqfq2-xqffxt-yh4dbs-4drmnm-s68gmy\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2580
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2652
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:784
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2708
- - C:\Users\Admin\AppData\Local\Temp\6vyrvu-9b07us-qa69ba-gs1nuk-mtzmwf\2.exe
    C:\Users\Admin\AppData\Local\Temp\6vyrvu-9b07us-qa69ba-gs1nuk-mtzmwf\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2840
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2052
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2304
- - C:\Users\Admin\AppData\Local\Temp\0ujvqv-ji2gsb-uimy10-18ygot-rv4kx4\2.exe
    C:\Users\Admin\AppData\Local\Temp\0ujvqv-ji2gsb-uimy10-18ygot-rv4kx4\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1728
- - C:\Users\Admin\AppData\Local\Temp\ftof0q-sjmgud-acgrlu-b36p0u-hzsxcn\2.exe
    C:\Users\Admin\AppData\Local\Temp\ftof0q-sjmgud-acgrlu-b36p0u-hzsxcn\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2744
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2288
- - C:\Users\Admin\AppData\Local\Temp\o8rnwq-8rzh86-lm89ru-s68zom-s28osm\2.exe
    C:\Users\Admin\AppData\Local\Temp\o8rnwq-8rzh86-lm89ru-s68zom-s28osm\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1688
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3020
- - C:\Users\Admin\AppData\Local\Temp\zzlget-nxd235-6lxm4m-76autk-ewmbfd\2.exe
    C:\Users\Admin\AppData\Local\Temp\zzlget-nxd235-6lxm4m-76autk-ewmbfd\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:304
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:852
- - C:\Users\Admin\AppData\Local\Temp\ip8bcs-dhbpjx-q69qdk-803142-9rtzj1\2.exe
    C:\Users\Admin\AppData\Local\Temp\ip8bcs-dhbpjx-q69qdk-803142-9rtzj1\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:620
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2680
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2824
- - C:\Users\Admin\AppData\Local\Temp\a8wxea-z1dsdm-tysx9s-5t0ptg-dd0gp8\2.exe
    C:\Users\Admin\AppData\Local\Temp\a8wxea-z1dsdm-tysx9s-5t0ptg-dd0gp8\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3896
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4092
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4004
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2452
- - C:\Users\Admin\AppData\Local\Temp\xja9ws-t52xdx-7po7hj-zse33q-1dsaso\2.exe
    C:\Users\Admin\AppData\Local\Temp\xja9ws-t52xdx-7po7hj-zse33q-1dsaso\2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:3632
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3676
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3368
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3420
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4052
- - C:\Users\Admin\AppData\Local\Temp\jdotrt-90ux14-3sxc79-ghvd1w-zaqose\2.exe
    C:\Users\Admin\AppData\Local\Temp\jdotrt-90ux14-3sxc79-ghvd1w-zaqose\2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2964
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4092
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3920
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3472
- - C:\Users\Admin\AppData\Local\Temp\c29j6a-ixwsi4-6qdmhf-q8lgsv-33u8cj\2.exe
    C:\Users\Admin\AppData\Local\Temp\c29j6a-ixwsi4-6qdmhf-q8lgsv-33u8cj\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4044
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3656
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1868
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3244
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3596
- - C:\Users\Admin\AppData\Local\Temp\31gudo-tjb8xy-yk97yt-c3vh3f-wrf14w\2.exe
    C:\Users\Admin\AppData\Local\Temp\31gudo-tjb8xy-yk97yt-c3vh3f-wrf14w\2.exe
    3⤵
    - Drops file in System32 directory
    PID:3412
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in Windows directory
      PID:3068
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4020
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3456
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3624
- - C:\Users\Admin\AppData\Local\Temp\npcvad-ufncw6-j3th6g-euwvcm-rktw69\2.exe
    C:\Users\Admin\AppData\Local\Temp\npcvad-ufncw6-j3th6g-euwvcm-rktw69\2.exe
    3⤵
    PID:3244
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3592
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4088
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3300
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3960
- - C:\Users\Admin\AppData\Local\Temp\r6d04j-sx2yij-yso6ud-d6zq9y-74ev54\2.exe
    C:\Users\Admin\AppData\Local\Temp\r6d04j-sx2yij-yso6ud-d6zq9y-74ev54\2.exe
    3⤵
    PID:4088
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      PID:3252
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3368
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:852
- - C:\Users\Admin\AppData\Local\Temp\m2asyt-tmajvl-tjb7zl-p52vgq-c3vh52\2.exe
    C:\Users\Admin\AppData\Local\Temp\m2asyt-tmajvl-tjb7zl-p52vgq-c3vh52\2.exe
    3⤵
    PID:4352
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in System32 directory
      PID:4412
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4584
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Drops file in Windows directory
      PID:4488
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4640
- - C:\Users\Admin\AppData\Local\Temp\ak4n8u-b5iuxt-ivtbjm-hx5rdn-cp85ks\2.exe
    C:\Users\Admin\AppData\Local\Temp\ak4n8u-b5iuxt-ivtbjm-hx5rdn-cp85ks\2.exe
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in Windows directory
      PID:5060
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4088
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Drops file in Windows directory
      PID:4120
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4256
- - C:\Users\Admin\AppData\Local\Temp\ip3vyx-0jy6qf-1an44e-xq41vi-mjlwvt\2.exe
    C:\Users\Admin\AppData\Local\Temp\ip3vyx-0jy6qf-1an44e-xq41vi-mjlwvt\2.exe
    3⤵
    PID:4492
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Drops file in System32 directory
      PID:4276
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5012
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Drops file in Windows directory
      PID:4268
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4488
- - C:\Users\Admin\AppData\Local\Temp\x75idv-0n8zcs-hme1tb-hifqxb-d46def\2.exe
    C:\Users\Admin\AppData\Local\Temp\x75idv-0n8zcs-hme1tb-hifqxb-d46def\2.exe
    3⤵
    PID:4900
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5028
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4156
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4272
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5024
- - C:\Users\Admin\AppData\Local\Temp\1j7hy7-tmxdke-v7bk9d-2xn1v6-rks64g\2.exe
    C:\Users\Admin\AppData\Local\Temp\1j7hy7-tmxdke-v7bk9d-2xn1v6-rks64g\2.exe
    3⤵
    PID:5696
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5768
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5252
- - C:\Users\Admin\AppData\Local\Temp\vka1qt-8982kg-q33dbx-rusbqx-xpfj2r\2.exe
    C:\Users\Admin\AppData\Local\Temp\vka1qt-8982kg-q33dbx-rusbqx-xpfj2r\2.exe
    3⤵
    PID:6128
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6104
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5916
- - C:\Users\Admin\AppData\Local\Temp\2f6enj-mye8zz-ytnzin-6dnqff-69nfjf\2.exe
    C:\Users\Admin\AppData\Local\Temp\2f6enj-mye8zz-ytnzin-6dnqff-69nfjf\2.exe
    3⤵
    PID:6060
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5144
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6136
- - C:\Users\Admin\AppData\Local\Temp\oylmbs-bwd805-ukxs1m-6khbba-dassx3\2.exe
    C:\Users\Admin\AppData\Local\Temp\oylmbs-bwd805-ukxs1m-6khbba-dassx3\2.exe
    3⤵
    PID:5952
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6128
- - C:\Users\Admin\AppData\Local\Temp\acisuh-44l71n-htj8ua-0nejmr-0e3h0q\2.exe
    C:\Users\Admin\AppData\Local\Temp\acisuh-44l71n-htj8ua-0nejmr-0e3h0q\2.exe
    3⤵
    PID:5828
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5544
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4192
- - C:\Users\Admin\AppData\Local\Temp\gjpcsa-4c66sl-y9lcor-a4t38f-iotu47\2.exe
    C:\Users\Admin\AppData\Local\Temp\gjpcsa-4c66sl-y9lcor-a4t38f-iotu47\2.exe
    3⤵
    PID:6772
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6820
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7080
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6880
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7032
- - C:\Users\Admin\AppData\Local\Temp\8ec405-404sha-ryxe6m-bngy83-c8u5w1\2.exe
    C:\Users\Admin\AppData\Local\Temp\8ec405-404sha-ryxe6m-bngy83-c8u5w1\2.exe
    3⤵
    PID:6664
- - C:\Users\Admin\AppData\Local\Temp\0vgjdm-pimomw-kap2t2-7ete8f-ftiee6\2.exe
    C:\Users\Admin\AppData\Local\Temp\0vgjdm-pimomw-kap2t2-7ete8f-ftiee6\2.exe
    3⤵
    PID:6880
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6476
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6220
- - C:\Users\Admin\AppData\Local\Temp\xdxj1z-39ksdt-s11nc5-mzgs9b-ofi888\2.exe
    C:\Users\Admin\AppData\Local\Temp\xdxj1z-39ksdt-s11nc5-mzgs9b-ofi888\2.exe
    3⤵
    PID:6464
- - C:\Users\Admin\AppData\Local\Temp\0ykyyd-rgebhn-whcaji-a1ykn4-tpi5pl\2.exe
    C:\Users\Admin\AppData\Local\Temp\0ykyyd-rgebhn-whcaji-a1ykn4-tpi5pl\2.exe
    3⤵
    PID:6328
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7144
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6616
- - C:\Users\Admin\AppData\Local\Temp\u45i80-1ugzut-qhm344-l9pia9-yymj4w\2.exe
    C:\Users\Admin\AppData\Local\Temp\u45i80-1ugzut-qhm344-l9pia9-yymj4w\2.exe
    3⤵
    PID:6628
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6308
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6836
- - C:\Users\Admin\AppData\Local\Temp\yl74vx-ycw2aw-48jamq-t005l2-dj8zxi\2.exe
    C:\Users\Admin\AppData\Local\Temp\yl74vx-ycw2aw-48jamq-t005l2-dj8zxi\2.exe
    3⤵
    PID:6464
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6924
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6608
- - C:\Users\Admin\AppData\Local\Temp\779s6k-er9j2c-ena86c-aa1vnh-x8uhct\2.exe
    C:\Users\Admin\AppData\Local\Temp\779s6k-er9j2c-ena86c-aa1vnh-x8uhct\2.exe
    3⤵
    PID:6688
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6620
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6920
- - C:\Users\Admin\AppData\Local\Temp\holqf0-jazx3z-q0afqs-o1mukt-jtp8qy\2.exe
    C:\Users\Admin\AppData\Local\Temp\holqf0-jazx3z-q0afqs-o1mukt-jtp8qy\2.exe
    3⤵
    PID:7196
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7276
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7504
- - C:\Users\Admin\AppData\Local\Temp\duc3gz-wo7e7h-wfwcmg-twc9dj-hpu4cv\2.exe
    C:\Users\Admin\AppData\Local\Temp\duc3gz-wo7e7h-wfwcmg-twc9dj-hpu4cv\2.exe
    3⤵
    PID:7960
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8056
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7192
- - C:\Users\Admin\AppData\Local\Temp\11a6ah-dwiyt5-lgjpqx-lcjdux-gzb1b2\2.exe
    C:\Users\Admin\AppData\Local\Temp\11a6ah-dwiyt5-lgjpqx-lcjdux-gzb1b2\2.exe
    3⤵
    PID:7852
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 404
        5⤵
        Program crash
        
        PID:8164
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8016
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6688
- - C:\Users\Admin\AppData\Local\Temp\xmkhpp-qpadbw-raok0v-y001mo-oo55vy\2.exe
    C:\Users\Admin\AppData\Local\Temp\xmkhpp-qpadbw-raok0v-y001mo-oo55vy\2.exe
    3⤵
    PID:7844
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7252
- - C:\Users\Admin\AppData\Local\Temp\w8y54f-9xv6y2-srqipk-sigg4j-yd2ogd\2.exe
    C:\Users\Admin\AppData\Local\Temp\w8y54f-9xv6y2-srqipk-sigg4j-yd2ogd\2.exe
    3⤵
    PID:7660
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7716
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7812
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7464
- - C:\Users\Admin\AppData\Local\Temp\87337u-spbxja-5kkp3y-mjqrkg-c1k43q\2.exe
    C:\Users\Admin\AppData\Local\Temp\87337u-spbxja-5kkp3y-mjqrkg-c1k43q\2.exe
    3⤵
    PID:7272
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7332
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7876
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7976
- - C:\Users\Admin\AppData\Local\Temp\9mbar4-n5xlvq-6th5w7-ht1o6w-ojc5sp\2.exe
    C:\Users\Admin\AppData\Local\Temp\9mbar4-n5xlvq-6th5w7-ht1o6w-ojc5sp\2.exe
    3⤵
    PID:7724
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7560
- - C:\Users\Admin\AppData\Local\Temp\c1swq6-6tvbwc-kitcqz-2conig-33dlwg\2.exe
    C:\Users\Admin\AppData\Local\Temp\c1swq6-6tvbwc-kitcqz-2conig-33dlwg\2.exe
    3⤵
    PID:760
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\ka43eu-zofnsf-tluspl-5g2k89-d02a51\2.exe
    C:\Users\Admin\AppData\Local\Temp\ka43eu-zofnsf-tluspl-5g2k89-d02a51\2.exe
    3⤵
    PID:7520
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1836
- - C:\Users\Admin\AppData\Local\Temp\3ks2iv-y6kqz0-m4cbnc-5swwpt-7ea3er\2.exe
    C:\Users\Admin\AppData\Local\Temp\3ks2iv-y6kqz0-m4cbnc-5swwpt-7ea3er\2.exe
    3⤵
    PID:7876
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7300
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7252
- - C:\Users\Admin\AppData\Local\Temp\dudaso-cwppmp-6ot3sv-jdq4mi-26lgez\2.exe
    C:\Users\Admin\AppData\Local\Temp\dudaso-cwppmp-6ot3sv-jdq4mi-26lgez\2.exe
    3⤵
    PID:7948
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8180
- - C:\Users\Admin\AppData\Local\Temp\uh5fv3-rylcm6-fq27li-9ohcio-b4jtgm\2.exe
    C:\Users\Admin\AppData\Local\Temp\uh5fv3-rylcm6-fq27li-9ohcio-b4jtgm\2.exe
    3⤵
    PID:7964
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7340
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7388
- - C:\Users\Admin\AppData\Local\Temp\s76wmx-s47kqx-nqz871-1alibn-ucbexu\2.exe
    C:\Users\Admin\AppData\Local\Temp\s76wmx-s47kqx-nqz871-1alibn-ucbexu\2.exe
    3⤵
    PID:7684
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7504
- - C:\Users\Admin\AppData\Local\Temp\468bkl-bwjt7e-0jpxgp-vbsbnu-80pchh\2.exe
    C:\Users\Admin\AppData\Local\Temp\468bkl-bwjt7e-0jpxgp-vbsbnu-80pchh\2.exe
    3⤵
    PID:7556
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8068
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\heo4mk-h5d20k-n00ace-cth5bp-wcpzn5\2.exe
    C:\Users\Admin\AppData\Local\Temp\heo4mk-h5d20k-n00ace-cth5bp-wcpzn5\2.exe
    3⤵
    PID:7432
- - C:\Users\Admin\AppData\Local\Temp\1lbudu-86bl9m-82baem-4o3xvr-rmwjj3\2.exe
    C:\Users\Admin\AppData\Local\Temp\1lbudu-86bl9m-82baem-4o3xvr-rmwjj3\2.exe
    3⤵
    PID:7536
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7740
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:760
- - C:\Users\Admin\AppData\Local\Temp\tbx5zx-4bhn8l-b1s5uf-0oy93p-vg1nav\2.exe
    C:\Users\Admin\AppData\Local\Temp\tbx5zx-4bhn8l-b1s5uf-0oy93p-vg1nav\2.exe
    3⤵
    PID:8048
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7380
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7816
- - C:\Users\Admin\AppData\Local\Temp\t94s06-b2z4ro-ctp26n-8a5zxr-x3mtw2\2.exe
    C:\Users\Admin\AppData\Local\Temp\t94s06-b2z4ro-ctp26n-8a5zxr-x3mtw2\2.exe
    3⤵
    PID:7720
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7312
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7708
- - C:\Users\Admin\AppData\Local\Temp\hi91d9-tdisxx-1xijtq-1ui8yq-xgawfu\2.exe
    C:\Users\Admin\AppData\Local\Temp\hi91d9-tdisxx-1xijtq-1ui8yq-xgawfu\2.exe
    3⤵
    PID:7988
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\8lzbzi-r9jw0z-tvx3py-0k8kbr-p8epk1\2.exe
    C:\Users\Admin\AppData\Local\Temp\8lzbzi-r9jw0z-tvx3py-0k8kbr-p8epk1\2.exe
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7256
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7372
- - C:\Users\Admin\AppData\Local\Temp\smp2uy-fqte9b-n5ieg3-ow7cu2-uruk6w\2.exe
    C:\Users\Admin\AppData\Local\Temp\smp2uy-fqte9b-n5ieg3-ow7cu2-uruk6w\2.exe
    3⤵
    PID:7280
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7536
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8140
- - C:\Users\Admin\AppData\Local\Temp\45ixeb-x2x2ai-0izi9f-hh5kqy-8z0ya7\2.exe
    C:\Users\Admin\AppData\Local\Temp\45ixeb-x2x2ai-0izi9f-hh5kqy-8z0ya7\2.exe
    3⤵
    PID:7988
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6796
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\vxtemw-9hfpqi-s5z9sz-35js1o-avu9nh\2.exe
    C:\Users\Admin\AppData\Local\Temp\vxtemw-9hfpqi-s5z9sz-35js1o-avu9nh\2.exe
    3⤵
    PID:7332
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7528
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7580
- - C:\Users\Admin\AppData\Local\Temp\4wlivx-znow22-ccmxwp-u6h9n7-vx6616\2.exe
    C:\Users\Admin\AppData\Local\Temp\4wlivx-znow22-ccmxwp-u6h9n7-vx6616\2.exe
    3⤵
    PID:7368
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7764
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\5ok057-uh1v4i-e09ogy-quigzm-yfi7we\2.exe
    C:\Users\Admin\AppData\Local\Temp\5ok057-uh1v4i-e09ogy-quigzm-yfi7we\2.exe
    3⤵
    PID:7084
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8176
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7800
- - C:\Users\Admin\AppData\Local\Temp\xjfgi9-s574ze-g4zpoq-zsjaq7-1dwhe5\2.exe
    C:\Users\Admin\AppData\Local\Temp\xjfgi9-s574ze-g4zpoq-zsjaq7-1dwhe5\2.exe
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7664
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\p4n8pg-o6yojh-jy22pm-wnz3j9-ehufbr\2.exe
    C:\Users\Admin\AppData\Local\Temp\p4n8pg-o6yojh-jy22pm-wnz3j9-ehufbr\2.exe
    3⤵
    PID:7760
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6920
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7320
- - C:\Users\Admin\AppData\Local\Temp\8gp76a-5x54xe-tqnzwp-nn14tw-ziawcj\2.exe
    C:\Users\Admin\AppData\Local\Temp\8gp76a-5x54xe-tqnzwp-nn14tw-ziawcj\2.exe
    3⤵
    PID:7272
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7568
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7084
- - C:\Users\Admin\AppData\Local\Temp\djs80a-dgtx5a-92llmf-nm7vq1-goxrc8\2.exe
    C:\Users\Admin\AppData\Local\Temp\djs80a-dgtx5a-92llmf-nm7vq1-goxrc8\2.exe
    3⤵
    PID:8016
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8068
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\069496-7wlmvz-wjrq59-rbu4bf-40r552\2.exe
    C:\Users\Admin\AppData\Local\Temp\069496-7wlmvz-wjrq59-rbu4bf-40r552\2.exe
    3⤵
    PID:7304
- - C:\Users\Admin\AppData\Local\Temp\5vplkp-6mejyo-ci1rai-0aim9u-ktqfla\2.exe
    C:\Users\Admin\AppData\Local\Temp\5vplkp-6mejyo-ci1rai-0aim9u-ktqfla\2.exe
    3⤵
    PID:7948
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7920
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7368
- - C:\Users\Admin\AppData\Local\Temp\944afl-q3acw4-hl5pge-mm3oh8-05pzlu\2.exe
    C:\Users\Admin\AppData\Local\Temp\944afl-q3acw4-hl5pge-mm3oh8-05pzlu\2.exe
    3⤵
    PID:2640
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7964
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7252
- - C:\Users\Admin\AppData\Local\Temp\eq3708-pqnq9x-wgz7vq-l34b41-gv8qb6\2.exe
    C:\Users\Admin\AppData\Local\Temp\eq3708-pqnq9x-wgz7vq-l34b41-gv8qb6\2.exe
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7292
- - C:\Users\Admin\AppData\Local\Temp\22sjtw-lwnuke-mncsyd-siz0a7-6wakps\2.exe
    C:\Users\Admin\AppData\Local\Temp\22sjtw-lwnuke-mncsyd-siz0a7-6wakps\2.exe
    3⤵
    PID:8120
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7304
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8180
- - C:\Users\Admin\AppData\Local\Temp\dbkx5l-p5tpp9-xqtfl1-xmu4p1-s9ms66\2.exe
    C:\Users\Admin\AppData\Local\Temp\dbkx5l-p5tpp9-xqtfl1-xmu4p1-s9ms66\2.exe
    3⤵
    PID:8100
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7572
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7948
- - C:\Users\Admin\AppData\Local\Temp\y7vi0k-hve221-jhs9r0-p74rdt-o9f67u\2.exe
    C:\Users\Admin\AppData\Local\Temp\y7vi0k-hve221-jhs9r0-p74rdt-o9f67u\2.exe
    3⤵
    PID:1720
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6796
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2448
- - C:\Users\Admin\AppData\Local\Temp\6elrqi-j3jsk4-1xe3bm-2o31pl-y4kyhp\2.exe
    C:\Users\Admin\AppData\Local\Temp\6elrqi-j3jsk4-1xe3bm-2o31pl-y4kyhp\2.exe
    3⤵
    PID:7692
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7432
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\myy1q5-gvc6nc-jbfnm9-0alp3s-07me7s\2.exe
    C:\Users\Admin\AppData\Local\Temp\myy1q5-gvc6nc-jbfnm9-0alp3s-07me7s\2.exe
    3⤵
    PID:2756
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7340
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8184
- - C:\Users\Admin\AppData\Local\Temp\imu1pq-w6gbtc-p957gk-ruje4i-ykvwrb\2.exe
    C:\Users\Admin\AppData\Local\Temp\imu1pq-w6gbtc-p957gk-ruje4i-ykvwrb\2.exe
    3⤵
    PID:940
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7292
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7584
- - C:\Users\Admin\AppData\Local\Temp\c0y967-7s1ndc-khyp7z-2bt0yh-32iydg\2.exe
    C:\Users\Admin\AppData\Local\Temp\c0y967-7s1ndc-khyp7z-2bt0yh-32iydg\2.exe
    3⤵
    PID:7320
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6796
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7332
- - C:\Users\Admin\AppData\Local\Temp\tok0z6-ig1vyh-2z9pax-euigtl-mei7qd\2.exe
    C:\Users\Admin\AppData\Local\Temp\tok0z6-ig1vyh-2z9pax-euigtl-mei7qd\2.exe
    3⤵
    PID:2056
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7288
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7396
- - C:\Users\Admin\AppData\Local\Temp\3cwb1a-zzozif-mxgl7r-6lz588-hlkoix\2.exe
    C:\Users\Admin\AppData\Local\Temp\3cwb1a-zzozif-mxgl7r-6lz588-hlkoix\2.exe
    3⤵
    PID:7372
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8184
- - C:\Users\Admin\AppData\Local\Temp\54sdl0-uryhub-pj1v1g-28zwv3-k2t8mk\2.exe
    C:\Users\Admin\AppData\Local\Temp\54sdl0-uryhub-pj1v1g-28zwv3-k2t8mk\2.exe
    3⤵
    PID:7572
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4028
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7528
- - C:\Users\Admin\AppData\Local\Temp\bcnjnf-8t4gej-wmlbdv-qjzga1-2d88up\2.exe
    C:\Users\Admin\AppData\Local\Temp\bcnjnf-8t4gej-wmlbdv-qjzga1-2d88up\2.exe
    3⤵
    PID:8112
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2668
- - C:\Users\Admin\AppData\Local\Temp\bzwsp5-bvxht5-6hp5a9-ufhqzm-d41b12\2.exe
    C:\Users\Admin\AppData\Local\Temp\bzwsp5-bvxht5-6hp5a9-ufhqzm-d41b12\2.exe
    3⤵
    PID:7920
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7292
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7396
- - C:\Users\Admin\AppData\Local\Temp\58jwcw-cyudyq-1m0h70-wd3we6-jh78tj\2.exe
    C:\Users\Admin\AppData\Local\Temp\58jwcw-cyudyq-1m0h70-wd3we6-jh78tj\2.exe
    3⤵
    PID:7928
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7332
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7736
- - C:\Users\Admin\AppData\Local\Temp\qttc0a-qkiaea-wg5iq4-l9mdpf-e61iml\2.exe
    C:\Users\Admin\AppData\Local\Temp\qttc0a-qkiaea-wg5iq4-l9mdpf-e61iml\2.exe
    3⤵
    PID:8132
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7536
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2564
- - C:\Users\Admin\AppData\Local\Temp\inp1uc-zmv3bu-p4pgv4-u5nfwz-8p9q0l\2.exe
    C:\Users\Admin\AppData\Local\Temp\inp1uc-zmv3bu-p4pgv4-u5nfwz-8p9q0l\2.exe
    3⤵
    PID:8184
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6648
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\n7x0pu-y7hiyj-5xt0lc-vkz4um-pc2i1s\2.exe
    C:\Users\Admin\AppData\Local\Temp\n7x0pu-y7hiyj-5xt0lc-vkz4um-pc2i1s\2.exe
    3⤵
    PID:7372
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8000
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2324
- - C:\Users\Admin\AppData\Local\Temp\nljag6-5fel7n-653jln-c1qsxh-0u7mws\2.exe
    C:\Users\Admin\AppData\Local\Temp\nljag6-5fel7n-653jln-c1qsxh-0u7mws\2.exe
    3⤵
    PID:6920
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8100
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8124
- - C:\Users\Admin\AppData\Local\Temp\53uai4-hx322s-pi3tyk-pe4h2k-k1v5jo\2.exe
    C:\Users\Admin\AppData\Local\Temp\53uai4-hx322s-pi3tyk-pe4h2k-k1v5jo\2.exe
    3⤵
    PID:7816
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8176
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\85qu6m-rt9e73-tfnmw1-z5z3iu-y6bicv\2.exe
    C:\Users\Admin\AppData\Local\Temp\85qu6m-rt9e73-tfnmw1-z5z3iu-y6bicv\2.exe
    3⤵
    PID:7768
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7596
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7724
- - C:\Users\Admin\AppData\Local\Temp\5ep3tv-i3m4ni-1xhffz-1o7dtz-y5nak2\2.exe
    C:\Users\Admin\AppData\Local\Temp\5ep3tv-i3m4ni-1xhffz-1o7dtz-y5nak2\2.exe
    3⤵
    PID:8116
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7188
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7328
- - C:\Users\Admin\AppData\Local\Temp\wc67lj-q9lchp-23u41d-aouvx5-akuk25\2.exe
    C:\Users\Admin\AppData\Local\Temp\wc67lj-q9lchp-23u41d-aouvx5-akuk25\2.exe
    3⤵
    PID:7584
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8100
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\i3zuhu-wnl4mg-pqb08n-rbp7xl-y10pje\2.exe
    C:\Users\Admin\AppData\Local\Temp\i3zuhu-wnl4mg-pqb08n-rbp7xl-y10pje\2.exe
    3⤵
    PID:7736
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8096
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\ye4rm3-t675t8-6v56nv-opzied-pfpgtc\2.exe
    C:\Users\Admin\AppData\Local\Temp\ye4rm3-t675t8-6v56nv-opzied-pfpgtc\2.exe
    3⤵
    PID:7332
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7692
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7556
- - C:\Users\Admin\AppData\Local\Temp\f3lzzb-3w2uyn-nfaoa3-09jfuq-h9phb9\2.exe
    C:\Users\Admin\AppData\Local\Temp\f3lzzb-3w2uyn-nfaoa3-09jfuq-h9phb9\2.exe
    3⤵
    PID:7772
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\s895v0-y974wv-ctte1h-vhdy2y-6hxhcm\2.exe
    C:\Users\Admin\AppData\Local\Temp\s895v0-y974wv-ctte1h-vhdy2y-6hxhcm\2.exe
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7604
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\f0zb6y-4n5ff8-zf8tme-c45ug1-ux067i\2.exe
    C:\Users\Admin\AppData\Local\Temp\f0zb6y-4n5ff8-zf8tme-c45ug1-ux067i\2.exe
    3⤵
    PID:6924
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7504
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8048
- - C:\Users\Admin\AppData\Local\Temp\xvztz2-3qm1bw-i4xlph-c2bqmn-owkh5b\2.exe
    C:\Users\Admin\AppData\Local\Temp\xvztz2-3qm1bw-i4xlph-c2bqmn-owkh5b\2.exe
    3⤵
    PID:8180
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7332
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8096
- - C:\Users\Admin\AppData\Local\Temp\5z9fr7-5wa3w7-0i2rdc-ogud1o-74dx35\2.exe
    C:\Users\Admin\AppData\Local\Temp\5z9fr7-5wa3w7-0i2rdc-ogud1o-74dx35\2.exe
    3⤵
    PID:8112
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\w0biqy-3qmzcr-2ryf6s-wj1tdx-a8yu7k\2.exe
    C:\Users\Admin\AppData\Local\Temp\w0biqy-3qmzcr-2ryf6s-wj1tdx-a8yu7k\2.exe
    3⤵
    PID:7632
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\945oxo-avumbo-6cbj2r-v4se13-p26jy9\2.exe
    C:\Users\Admin\AppData\Local\Temp\945oxo-avumbo-6cbj2r-v4se13-p26jy9\2.exe
    3⤵
    PID:1656
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7432
- - C:\Users\Admin\AppData\Local\Temp\waapaj-e9hrr1-d5hgw1-9s94d6-nbvehs\2.exe
    C:\Users\Admin\AppData\Local\Temp\waapaj-e9hrr1-d5hgw1-9s94d6-nbvehs\2.exe
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8176
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7816
- - C:\Users\Admin\AppData\Local\Temp\gg6cds-i1kj1q-prw1nj-ee15xu-965j3z\2.exe
    C:\Users\Admin\AppData\Local\Temp\gg6cds-i1kj1q-prw1nj-ee15xu-965j3z\2.exe
    3⤵
    PID:7384
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8004
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\ufozyv-d8jbpc-ez893c-kvvhf6-8ncceh\2.exe
    C:\Users\Admin\AppData\Local\Temp\ufozyv-d8jbpc-ez893c-kvvhf6-8ncceh\2.exe
    3⤵
    PID:4020
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7632
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7288
- - C:\Users\Admin\AppData\Local\Temp\ii6jxb-ucfbhz-2xf2dr-2tgrhr-xg8eyv\2.exe
    C:\Users\Admin\AppData\Local\Temp\ii6jxb-ucfbhz-2xf2dr-2tgrhr-xg8eyv\2.exe
    3⤵
    PID:7332
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\bx68ro-vlqss5-6lab2u-dblson-2yrwxx\2.exe
    C:\Users\Admin\AppData\Local\Temp\bx68ro-vlqss5-6lab2u-dblson-2yrwxx\2.exe
    3⤵
    PID:7816
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2752
- - C:\Users\Admin\AppData\Local\Temp\fukyvr-sjhzoe-adcbgw-b419uv-8li6lz\2.exe
    C:\Users\Admin\AppData\Local\Temp\fukyvr-sjhzoe-adcbgw-b419uv-8li6lz\2.exe
    3⤵
    PID:7736
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7240
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\ntlj2s-hqzoyz-tl8gin-1586ef-119vjf\2.exe
    C:\Users\Admin\AppData\Local\Temp\ntlj2s-hqzoyz-tl8gin-1586ef-119vjf\2.exe
    3⤵
    PID:7288
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2012
- - C:\Users\Admin\AppData\Local\Temp\vlyn0k-ijq8pw-17atqd-3to0fb-ajzi14\2.exe
    C:\Users\Admin\AppData\Local\Temp\vlyn0k-ijq8pw-17atqd-3to0fb-ajzi14\2.exe
    3⤵
    PID:7456
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8168
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4020
- - C:\Users\Admin\AppData\Local\Temp\rqxtwy-li1734-8m4khh-h1tko8-irii28\2.exe
    C:\Users\Admin\AppData\Local\Temp\rqxtwy-li1734-8m4khh-h1tko8-irii28\2.exe
    3⤵
    PID:8056
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7556
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7948
- - C:\Users\Admin\AppData\Local\Temp\10p6uh-pt61ts-jqk6pz-l6nnow-35tp5f\2.exe
    C:\Users\Admin\AppData\Local\Temp\10p6uh-pt61ts-jqk6pz-l6nnow-35tp5f\2.exe
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1656
- - C:\Users\Admin\AppData\Local\Temp\nn5a55-so396z-67pjal-qv83c2-1vsmlr\2.exe
    C:\Users\Admin\AppData\Local\Temp\nn5a55-so396z-67pjal-qv83c2-1vsmlr\2.exe
    3⤵
    PID:8100
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:760
- - C:\Users\Admin\AppData\Local\Temp\9hf520-y5l9bb-twooig-6mmpc3-ofg03l\2.exe
    C:\Users\Admin\AppData\Local\Temp\9hf520-y5l9bb-twooig-6mmpc3-ofg03l\2.exe
    3⤵
    PID:8176
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7392
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4540
- - C:\Users\Admin\AppData\Local\Temp\8262zu-exsabo-3q95a0-n9iymg-z3qq53\2.exe
    C:\Users\Admin\AppData\Local\Temp\8262zu-exsabo-3q95a0-n9iymg-z3qq53\2.exe
    3⤵
    PID:7952
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4716
- - C:\Users\Admin\AppData\Local\Temp\rav7l4-r6vwp4-ntnk69-arg5vl-ufzqx2\2.exe
    C:\Users\Admin\AppData\Local\Temp\rav7l4-r6vwp4-ntnk69-arg5vl-ufzqx2\2.exe
    3⤵
    PID:7316
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7368
- - C:\Users\Admin\AppData\Local\Temp\6egxvg-d4seh9-b63tba-6y78if-jn49c2\2.exe
    C:\Users\Admin\AppData\Local\Temp\6egxvg-d4seh9-b63tba-6y78if-jn49c2\2.exe
    3⤵
    PID:8124
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7596
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2740
- - C:\Users\Admin\AppData\Local\Temp\nw2a0i-onr8fh-k3856l-9wp05x-2t3523\2.exe
    C:\Users\Admin\AppData\Local\Temp\nw2a0i-onr8fh-k3856l-9wp05x-2t3523\2.exe
    3⤵
    PID:7716
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8188
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\940yi2-hp0peu-hl0eiu-c7s1zz-qrec3l\2.exe
    C:\Users\Admin\AppData\Local\Temp\940yi2-hp0peu-hl0eiu-c7s1zz-qrec3l\2.exe
    3⤵
    PID:7604
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7596
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\1ytvgg-3j725e-a9jkr7-zxoo1i-uos27o\2.exe
    C:\Users\Admin\AppData\Local\Temp\1ytvgg-3j725e-a9jkr7-zxoo1i-uos27o\2.exe
    3⤵
    PID:7736
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7964
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\ytaoai-hn5010-heuygz-n9h6st-c2y1r5\2.exe
    C:\Users\Admin\AppData\Local\Temp\ytaoai-hn5010-heuygz-n9h6st-c2y1r5\2.exe
    3⤵
    PID:8004
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7768
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7312
- - C:\Users\Admin\AppData\Local\Temp\ui5wbv-6cdnvj-obkqc2-ete3vc-juc2x6\2.exe
    C:\Users\Admin\AppData\Local\Temp\ui5wbv-6cdnvj-obkqc2-ete3vc-juc2x6\2.exe
    3⤵
    PID:7392
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7084
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8112
- - C:\Users\Admin\AppData\Local\Temp\pyrknc-8ma4ot-jmvnyh-qc64ka-fzc8tl\2.exe
    C:\Users\Admin\AppData\Local\Temp\pyrknc-8ma4ot-jmvnyh-qc64ka-fzc8tl\2.exe
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7272
- - C:\Users\Admin\AppData\Local\Temp\ssuuxi-5hsvr5-nan6in-o1c4wm-uxzc8g\2.exe
    C:\Users\Admin\AppData\Local\Temp\ssuuxi-5hsvr5-nan6in-o1c4wm-uxzc8g\2.exe
    3⤵
    PID:7964
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7928
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7392
- - C:\Users\Admin\AppData\Local\Temp\p52hxw-j3hnu2-vxpedq-3ip5ai-3equei\2.exe
    C:\Users\Admin\AppData\Local\Temp\p52hxw-j3hnu2-vxpedq-3ip5ai-3equei\2.exe
    3⤵
    PID:7384
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7288
- - C:\Users\Admin\AppData\Local\Temp\jsvhoy-6qn3da-pe7ner-rzlu3p-ypwcpi\2.exe
    C:\Users\Admin\AppData\Local\Temp\jsvhoy-6qn3da-pe7ner-rzlu3p-ypwcpi\2.exe
    3⤵
    PID:1216
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4028
- - C:\Users\Admin\AppData\Local\Temp\esn171-9kqge6-m9nh8t-43iszb-5u8qea\2.exe
    C:\Users\Admin\AppData\Local\Temp\esn171-9kqge6-m9nh8t-43iszb-5u8qea\2.exe
    3⤵
    PID:6924
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7608
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7240
- - C:\Users\Admin\AppData\Local\Temp\dzpdpm-2s68oy-vpkdk4-y5ntj2-f4tv0k\2.exe
    C:\Users\Admin\AppData\Local\Temp\dzpdpm-2s68oy-vpkdk4-y5ntj2-f4tv0k\2.exe
    3⤵
    PID:7748
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2640
- - C:\Users\Admin\AppData\Local\Temp\38phrm-yuh48q-ce3fcc-5htbyj-727ini\2.exe
    C:\Users\Admin\AppData\Local\Temp\38phrm-yuh48q-ce3fcc-5htbyj-727ini\2.exe
    3⤵
    PID:7928
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7312
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8180
- - C:\Users\Admin\AppData\Local\Temp\ywm9oe-oksdyp-ibvr4u-v0tsyh-euo4qz\2.exe
    C:\Users\Admin\AppData\Local\Temp\ywm9oe-oksdyp-ibvr4u-v0tsyh-euo4qz\2.exe
    3⤵
    PID:7268
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7584
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8052
- - C:\Users\Admin\AppData\Local\Temp\wpevvz-2k147t-qdiy64-awqsik-nqzk28\2.exe
    C:\Users\Admin\AppData\Local\Temp\wpevvz-2k147t-qdiy64-awqsik-nqzk28\2.exe
    3⤵
    PID:2564
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7312
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7820
- - C:\Users\Admin\AppData\Local\Temp\93qrhw-9zrflw-4lj321-skbprd-b8v9tu\2.exe
    C:\Users\Admin\AppData\Local\Temp\93qrhw-9zrflw-4lj321-skbprd-b8v9tu\2.exe
    3⤵
    PID:7596
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8124
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7268
- - C:\Users\Admin\AppData\Local\Temp\vnibxe-2dttj7-s1zxti-ms2bzn-zh0cta\2.exe
    C:\Users\Admin\AppData\Local\Temp\vnibxe-2dttj7-s1zxti-ms2bzn-zh0cta\2.exe
    3⤵
    PID:7304
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7396
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7500
- - C:\Users\Admin\AppData\Local\Temp\t0ve50-urlcjz-q718a3-f0i39f-8xx86l\2.exe
    C:\Users\Admin\AppData\Local\Temp\t0ve50-urlcjz-q718a3-f0i39f-8xx86l\2.exe
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2056
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7292
- - C:\Users\Admin\AppData\Local\Temp\v690zo-3q9rwg-3n9f0g-y913hl-m7tp6x\2.exe
    C:\Users\Admin\AppData\Local\Temp\v690zo-3q9rwg-3n9f0g-y913hl-m7tp6x\2.exe
    3⤵
    PID:3040
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7556
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\oreaxy-qcshmw-x23z8p-mq93h0-hhcho5\2.exe
    C:\Users\Admin\AppData\Local\Temp\oreaxy-qcshmw-x23z8p-mq93h0-hhcho5\2.exe
    3⤵
    PID:4812
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6920
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7768
- - C:\Users\Admin\AppData\Local\Temp\mi8z22-vxwz9t-womxns-2j86zm-qcp0yy\2.exe
    C:\Users\Admin\AppData\Local\Temp\mi8z22-vxwz9t-womxns-2j86zm-qcp0yy\2.exe
    3⤵
    PID:7504
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7396
- - C:\Users\Admin\AppData\Local\Temp\qqtswj-t6w8ug-a52acz-0nwnv9-5numx4\2.exe
    C:\Users\Admin\AppData\Local\Temp\qqtswj-t6w8ug-a52acz-0nwnv9-5numx4\2.exe
    3⤵
    PID:2796
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2740
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\ulkwb5-d93hcm-o9nzma-vzzh83-lm4lhe\2.exe
    C:\Users\Admin\AppData\Local\Temp\ulkwb5-d93hcm-o9nzma-vzzh83-lm4lhe\2.exe
    3⤵
    PID:8016
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8056
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7220
- - C:\Users\Admin\AppData\Local\Temp\52q2ox-irn3ik-1kif91-2b7cn1-87ulzv\2.exe
    C:\Users\Admin\AppData\Local\Temp\52q2ox-irn3ik-1kif91-2b7cn1-87ulzv\2.exe
    3⤵
    PID:8176
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2912
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2056
- - C:\Users\Admin\AppData\Local\Temp\lyeep7-5hm71n-hbvzlb-pwvqh3-psvfl3\2.exe
    C:\Users\Admin\AppData\Local\Temp\lyeep7-5hm71n-hbvzlb-pwvqh3-psvfl3\2.exe
    3⤵
    PID:7748
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7740
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:840
- - C:\Users\Admin\AppData\Local\Temp\dpmhvr-1of2k4-kcynml-lxcuaj-snocwc\2.exe
    C:\Users\Admin\AppData\Local\Temp\dpmhvr-1of2k4-kcynml-lxcuaj-snocwc\2.exe
    3⤵
    PID:5196
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\jbha5a-d3locg-qsip63-9ld0xk-9c2ybk\2.exe
    C:\Users\Admin\AppData\Local\Temp\jbha5a-d3locg-qsip63-9ld0xk-9c2ybk\2.exe
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7300
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:928
- - C:\Users\Admin\AppData\Local\Temp\f8nc6t-414754-xyjc2b-atr4ly-hdrvir\2.exe
    C:\Users\Admin\AppData\Local\Temp\f8nc6t-414754-xyjc2b-atr4ly-hdrvir\2.exe
    3⤵
    PID:7336
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2216
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7692
- - C:\Users\Admin\AppData\Local\Temp\6qwvq7-2coj7c-gwatby-8z0px5-akdwm3\2.exe
    C:\Users\Admin\AppData\Local\Temp\6qwvq7-2coj7c-gwatby-8z0px5-akdwm3\2.exe
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8016
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\zb4owe-oy9s5p-jqc6cu-wfa76h-e95jxz\2.exe
    C:\Users\Admin\AppData\Local\Temp\zb4owe-oy9s5p-jqc6cu-wfa76h-e95jxz\2.exe
    3⤵
    PID:6924
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8000
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2212
- - C:\Users\Admin\AppData\Local\Temp\890bti-e4nj4c-3x4e4o-nfc8f4-zal0zs\2.exe
    C:\Users\Admin\AppData\Local\Temp\890bti-e4nj4c-3x4e4o-nfc8f4-zal0zs\2.exe
    3⤵
    PID:7508
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1632
- - C:\Users\Admin\AppData\Local\Temp\ekefl9-528s5j-a36r6e-ons1a0-7bcmch\2.exe
    C:\Users\Admin\AppData\Local\Temp\ekefl9-528s5j-a36r6e-ons1a0-7bcmch\2.exe
    3⤵
    PID:7272
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7500
- - C:\Users\Admin\AppData\Local\Temp\qm1hf6-xccy1z-m0i2aa-hrlhhg-ugiib2\2.exe
    C:\Users\Admin\AppData\Local\Temp\qm1hf6-xccy1z-m0i2aa-hrlhhg-ugiib2\2.exe
    3⤵
    PID:2344
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7252
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:840
- - C:\Users\Admin\AppData\Local\Temp\d7n1fg-eyczuf-ktz769-z7aqku-t5ovh0\2.exe
    C:\Users\Admin\AppData\Local\Temp\d7n1fg-eyczuf-ktz769-z7aqku-t5ovh0\2.exe
    3⤵
    PID:1056
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:2632

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2424

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1592

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2484

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:1700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2604

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1796

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1688

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3580

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:3376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4044

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4240

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4596

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:3368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4088

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4340

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4356

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:4640

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4124

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4560

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5016

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5300

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6000

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5704

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4364

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3268

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7156

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6840

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6408

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6180

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6216

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6428

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7356

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7496

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads