pykspa | fba54a1e535fd297b65592dfcdf1fb54a75af0a4e496d924ea15eac85eec1a2e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
Size

492KB
MD5

95740da3398074068a3996678d1bd6ab
SHA1

de012d8f2e88279034b24544e88df79b500234e7
SHA256

fba54a1e535fd297b65592dfcdf1fb54a75af0a4e496d924ea15eac85eec1a2e
SHA512

cfac8aec23668a899e878bdc133475567b55fe4dfae735356f0756927fdf324380f74982cad2d64f69c4ef0894b8bd9d7b74c1e884298170ed3df103ac13eaa2
SSDEEP

6144:+jg5pk1GS0xX3lPtbNN/DNRgkpiZzjhDQ0oeGF91YVusYJx+9sisyYpFTOOzHNNl:mg5pBHxXptbN5ZRgOiBjw/C0AWzFjRo2

Score

10^/10

pykspa defense_evasion discovery persistence trojan worm

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	gncxrwpmqxm.exe

Pykspa
Pykspa is a worm spreads via Skype uses DGA and it's written in C++.
worm pykspa
Pykspa family
pykspa

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gncxrwpmqxm.exe

Detect Pykspa worm 2 IoCs

worm

resource	yara_rule
behavioral2/files/0x00050000000227b2-4.dat	family_pykspa
behavioral2/files/0x000d000000024127-84.dat	family_pykspa

Adds policy Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kscprfit = "ukcxhdohuhpbvvue.exe"	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xcjts = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vojhuthdtjujgjlyzez.exe"	gncxrwpmqxm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	gncxrwpmqxm.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gncxrwpmqxm.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	icyxllaxofrhfjmaciey.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	vojhuthdtjujgjlyzez.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	xsppefvtldqhglpeholgd.exe

Executes dropped EXE 12 IoCs

pid	Process
1212	gncxrwpmqxm.exe
888	icyxllaxofrhfjmaciey.exe
1976	icyxllaxofrhfjmaciey.exe
4936	gncxrwpmqxm.exe
5016	kcwtfdqlapznjlmyyc.exe
3944	vojhuthdtjujgjlyzez.exe
2480	bslhspbvjxgtoppaz.exe
60	xsppefvtldqhglpeholgd.exe
2568	gncxrwpmqxm.exe
1040	gncxrwpmqxm.exe
3120	bslhspbvjxgtoppaz.exe
5780	ukcxhdohuhpbvvue.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mymdjbixgptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bslhspbvjxgtoppaz.exe"	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pandizftbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xsppefvtldqhglpeholgd.exe ."	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iowhht = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bslhspbvjxgtoppaz.exe"	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vclxyln = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ukcxhdohuhpbvvue.exe ."	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iowhht = "icyxllaxofrhfjmaciey.exe"	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vclxyln = "icyxllaxofrhfjmaciey.exe ."	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bkvjmbfrx = "kcwtfdqlapznjlmyyc.exe"	gncxrwpmqxm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ueqfjzeryf = "vojhuthdtjujgjlyzez.exe ."	gncxrwpmqxm.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gncxrwpmqxm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gncxrwpmqxm.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	www.showmyipaddress.com
35	www.whatismyip.ca
41	whatismyip.everdot.org
42	whatismyipaddress.com
50	www.whatismyip.ca
54	whatismyip.everdot.org
55	www.whatismyip.ca

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\icyxllaxofrhfjmaciey.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\xsppefvtldqhglpeholgd.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\okijzbsrkdrjjpukowuqop.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\ukcxhdohuhpbvvue.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\bslhspbvjxgtoppaz.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\kcwtfdqlapznjlmyyc.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\SysWOW64\vojhuthdtjujgjlyzez.exe	gncxrwpmqxm.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bslhspbvjxgtoppaz.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\kcwtfdqlapznjlmyyc.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\vojhuthdtjujgjlyzez.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\icyxllaxofrhfjmaciey.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\xsppefvtldqhglpeholgd.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\okijzbsrkdrjjpukowuqop.exe	gncxrwpmqxm.exe
File opened for modification	C:\Windows\ukcxhdohuhpbvvue.exe	gncxrwpmqxm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icyxllaxofrhfjmaciey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icyxllaxofrhfjmaciey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kcwtfdqlapznjlmyyc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vojhuthdtjujgjlyzez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukcxhdohuhpbvvue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bslhspbvjxgtoppaz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsppefvtldqhglpeholgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gncxrwpmqxm.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 1212	2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe	88
PID 2520 wrote to memory of 1212	2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe	88
PID 2520 wrote to memory of 1212	2520	JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe	88
PID 380 wrote to memory of 888	380	cmd.exe	93
PID 380 wrote to memory of 888	380	cmd.exe	93
PID 380 wrote to memory of 888	380	cmd.exe	93
PID 5440 wrote to memory of 1976	5440	cmd.exe	96
PID 5440 wrote to memory of 1976	5440	cmd.exe	96
PID 5440 wrote to memory of 1976	5440	cmd.exe	96
PID 1976 wrote to memory of 4936	1976	icyxllaxofrhfjmaciey.exe	97
PID 1976 wrote to memory of 4936	1976	icyxllaxofrhfjmaciey.exe	97
PID 1976 wrote to memory of 4936	1976	icyxllaxofrhfjmaciey.exe	97
PID 4888 wrote to memory of 5016	4888	cmd.exe	102
PID 4888 wrote to memory of 5016	4888	cmd.exe	102
PID 4888 wrote to memory of 5016	4888	cmd.exe	102
PID 2028 wrote to memory of 3944	2028	cmd.exe	106
PID 2028 wrote to memory of 3944	2028	cmd.exe	106
PID 2028 wrote to memory of 3944	2028	cmd.exe	106
PID 3648 wrote to memory of 2480	3648	cmd.exe	109
PID 3648 wrote to memory of 2480	3648	cmd.exe	109
PID 3648 wrote to memory of 2480	3648	cmd.exe	109
PID 1740 wrote to memory of 60	1740	cmd.exe	111
PID 1740 wrote to memory of 60	1740	cmd.exe	111
PID 1740 wrote to memory of 60	1740	cmd.exe	111
PID 3944 wrote to memory of 2568	3944	vojhuthdtjujgjlyzez.exe	112
PID 3944 wrote to memory of 2568	3944	vojhuthdtjujgjlyzez.exe	112
PID 3944 wrote to memory of 2568	3944	vojhuthdtjujgjlyzez.exe	112
PID 60 wrote to memory of 1040	60	xsppefvtldqhglpeholgd.exe	174
PID 60 wrote to memory of 1040	60	xsppefvtldqhglpeholgd.exe	174
PID 60 wrote to memory of 1040	60	xsppefvtldqhglpeholgd.exe	174
PID 3716 wrote to memory of 3120	3716	cmd.exe	118
PID 3716 wrote to memory of 3120	3716	cmd.exe	118
PID 3716 wrote to memory of 3120	3716	cmd.exe	118
PID 4448 wrote to memory of 5780	4448	cmd.exe	119
PID 4448 wrote to memory of 5780	4448	cmd.exe	119
PID 4448 wrote to memory of 5780	4448	cmd.exe	119

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	gncxrwpmqxm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gncxrwpmqxm.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95740da3398074068a3996678d1bd6ab.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_95740da3398074068a3996678d1bd6ab.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\iowhht.exe
    "C:\Users\Admin\AppData\Local\Temp\iowhht.exe" "-C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe"
    3⤵
    PID:5460
- - C:\Users\Admin\AppData\Local\Temp\iowhht.exe
    "C:\Users\Admin\AppData\Local\Temp\iowhht.exe" "-C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe"
    3⤵
    PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    - Executes dropped EXE
    PID:4936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    - Executes dropped EXE
    PID:2568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    - Executes dropped EXE
    PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  - Executes dropped EXE
  PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5780
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1168
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:3996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:2552
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:5420
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:4984
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:5876
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:2912
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:5192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5556
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:5204
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:5260
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4372
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:1044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:3900
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:4600
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:6000
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:4652
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:1040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4584
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5440
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:2180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:4008
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:5688
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:5388
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:3556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:628
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4848
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1280
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:2044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:2056
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:836
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:5456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:3424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2924
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:652
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:3768
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:4752
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:4592
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4420
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4844
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:4896
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5380
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5072
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:3888
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:2060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5012
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:6028
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:1200
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:1696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:60
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4924
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4292
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:4652
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4368
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:5776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:5192
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:1048
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:4456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3716
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:3152
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:3440
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5236
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:5556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5024
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:2304
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:2932
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:3044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:2456
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:640
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:2288
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5044
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:3256
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2604
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:5072
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5988
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:888
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:1692
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5688
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:720
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:336
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1108
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:4368
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:6096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:5516
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5172
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:1156
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4908
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:5192
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3188
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5880
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:4968
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:780
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5268
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:3456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:640
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:2060
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4572
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:2288
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:1336
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:2604
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:3396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4568
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5412
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:2044
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:1620
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:5228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4596
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5148
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:536
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:4224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:3144
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4252
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4764
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:4380
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2316
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:2612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:5288
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:4668
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:1424
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:5240
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:3512
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:4592

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe .
1⤵
PID:5076
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
  2⤵
  PID:4720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:3572
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:3664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:2268
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:3376
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2620
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:4288
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5576
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:5652
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5784
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:5072
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:2044
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:4360
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:720
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2572
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:1108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:984
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5424
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2988
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:1212
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5156
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:4296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:5504

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
1⤵
PID:4728

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe
1⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:784

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe .
1⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
1⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5300

C:\Windows\kcwtfdqlapznjlmyyc.exe
kcwtfdqlapznjlmyyc.exe
1⤵
PID:4712

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:3772

C:\Windows\icyxllaxofrhfjmaciey.exe
icyxllaxofrhfjmaciey.exe .
1⤵
PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:2080
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
  2⤵
  PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
1⤵
PID:4524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4296
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:5880

C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4644

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
1⤵
PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:4700
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:4052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:5640
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:5916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:456
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:5368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:388
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:2288
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5228
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5592
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:392
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:2692
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4764

C:\Windows\ukcxhdohuhpbvvue.exe
ukcxhdohuhpbvvue.exe
1⤵
PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:5924
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:3144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:816
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2612
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1308
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4888
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:2888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5932
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4056
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4624

C:\Windows\ukcxhdohuhpbvvue.exe
ukcxhdohuhpbvvue.exe
1⤵
PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4912
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:5676
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4836
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:1864
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:2040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:412
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:2620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:4028
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:1524
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:2268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:1820
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:3084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:4212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:5404
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2080

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
1⤵
PID:3480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5148
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4952
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3756
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4852
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:5976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:3648
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:4728
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4540
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5652
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4844
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:220
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5640
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:5368
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:5208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4840
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5788
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:5792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:2924
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:688

C:\Windows\kcwtfdqlapznjlmyyc.exe
kcwtfdqlapznjlmyyc.exe
1⤵
PID:5572

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:6120

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
1⤵
PID:1680

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:2760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:5412
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:1424
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:6072
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4764

C:\Windows\ukcxhdohuhpbvvue.exe
ukcxhdohuhpbvvue.exe
1⤵
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:4052

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe
1⤵
PID:640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:1804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:3800

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
1⤵
PID:4836

C:\Windows\xsppefvtldqhglpeholgd.exe
xsppefvtldqhglpeholgd.exe
1⤵
PID:2372

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe
1⤵
PID:6120

C:\Windows\kcwtfdqlapznjlmyyc.exe
kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5836

C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:528

C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:5900
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
  2⤵
  PID:3580

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
1⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
1⤵
PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:2712
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4780
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:1892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:3004

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe .
1⤵
PID:4232
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
  2⤵
  PID:1772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:2288
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:4488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1556
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5340
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:920
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:5524
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5876
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:2880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4568
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:2016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5072
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5052
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:1144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:312
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:1792
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:6028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:688
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:5312
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:3188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:4664
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:3608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1264
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5640
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:1772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:3120
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4608
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:1584
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:5216
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5592

C:\Windows\icyxllaxofrhfjmaciey.exe
icyxllaxofrhfjmaciey.exe .
1⤵
PID:528
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
  2⤵
  PID:2424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:3616
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5116
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:3572
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:4360
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1748
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4760
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4288
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:1028
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:428
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:3288
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:696
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5944
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:6116
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:1888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5312
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:3804
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:3004
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:6112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:3168
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:952
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:2080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4756
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5668
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:5860
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4328
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:1620
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1032
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
  2⤵
  PID:4028

C:\Windows\xsppefvtldqhglpeholgd.exe
xsppefvtldqhglpeholgd.exe .
1⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:2084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:4856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:2152
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:2596

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
1⤵
PID:3228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5432
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:336
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4360

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:4344
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:1748
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1372
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3288
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:3756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:4724
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:4888
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:5660

C:\Windows\kcwtfdqlapznjlmyyc.exe
kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4944
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
  2⤵
  PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:4516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:4608
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1888
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:2632
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5656
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:5580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:3376
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5100
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:2596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:404
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:6120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:2224
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:3424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:4212
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:5032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:2604
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:2016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:6092
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5432
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5700
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:4872
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5672
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:1648
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:2432
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:6000
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:60
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:2188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5640
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:3708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:1268
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:5184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5556
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5172

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1140
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:6004
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:872
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:5516
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:2672
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:3344
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:4924
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1308
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:628
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:3800
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:4756
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:3168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:3736
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:2932
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:5776
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:5116
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:3556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:2516
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:1192
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:2428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5384
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:5428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:3288
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:312
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:5240
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:5780

C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
  2⤵
  PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:4900

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe
1⤵
PID:5848

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:4836
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
  2⤵
  PID:5052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:2152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1504

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe
1⤵
PID:3260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5948
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:404

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
1⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
1⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:3788

C:\Windows\icyxllaxofrhfjmaciey.exe
icyxllaxofrhfjmaciey.exe .
1⤵
PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:2028
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5440
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:6112

C:\Windows\icyxllaxofrhfjmaciey.exe
icyxllaxofrhfjmaciey.exe
1⤵
PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:6028
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:3984

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:5396
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:3176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:2832
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:5424
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:5228
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:2208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4244
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:3120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:2452
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:6036
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:4568
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:2084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1932
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4064
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:4340
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:3168
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:1792
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:4108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:4840
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5836
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:5388
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  2⤵
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5672
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2912
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:2984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:1648
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:5368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:312
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5252
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1196

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:4608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:2760
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:1564
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:1268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:3796
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:6140
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:5336
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:3572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4576
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:6004
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:1216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:6136
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:5404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1856
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:4796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:1808
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3492
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5088
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:1192
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:2932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:2016
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:464
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5260
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5836
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:5056
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:920
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1900
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:3288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:2240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:2316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:3256
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:2988
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:2708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:1556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:3148
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:3176

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe .
1⤵
PID:4736
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
  2⤵
  PID:1812

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
1⤵
PID:4824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:5008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:3344

C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3376

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:2604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5520
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:5048
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:736

C:\Windows\xsppefvtldqhglpeholgd.exe
xsppefvtldqhglpeholgd.exe .
1⤵
PID:4540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:5688
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:1212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1900
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:5440

C:\Windows\icyxllaxofrhfjmaciey.exe
icyxllaxofrhfjmaciey.exe .
1⤵
PID:3580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
1⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5204
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
  2⤵
  PID:392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:456
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:1820
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:1372
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:4700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5884
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:1888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:3944
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:1660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:4348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:5284
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:4268

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:3780
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:544
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:2560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:2032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:4720
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:5340
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5208

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:2344
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:3816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:2448
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:5260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:464
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4320
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5708
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4984
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:816
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:5988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:3556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:6112
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe
  2⤵
  PID:4648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:1164
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:4884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:2948
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:5204
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:1124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1740
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:4588
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4656
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4924
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:2132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:6040
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:1892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe .
1⤵
PID:3440
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:2212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2452
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:3568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:6108
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:2560
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:4856
- C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
  C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
  2⤵
  PID:3376
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:2080
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  2⤵
  PID:3548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:216
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:220
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:1944
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:5848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4456
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5148
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\ukcxhdohuhpbvvue.exe*."
    3⤵
    PID:1504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:404
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:1900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4640
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3732
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:5576
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:4884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4816
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4888
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:412

C:\Windows\ukcxhdohuhpbvvue.exe
ukcxhdohuhpbvvue.exe
1⤵
PID:312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:3176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:1584
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:1372

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\xsppefvtldqhglpeholgd.exe*."
1⤵
PID:1740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:3608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:1280
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:6140

C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:2264
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe
  2⤵
  PID:4836

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe .
1⤵
PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:2160

C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
"C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
1⤵
PID:4444

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe
1⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:2916

C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3028
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
  2⤵
  PID:4712

C:\Windows\kcwtfdqlapznjlmyyc.exe
kcwtfdqlapznjlmyyc.exe .
1⤵
PID:2508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5672
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:3828

C:\Windows\vojhuthdtjujgjlyzez.exe
vojhuthdtjujgjlyzez.exe .
1⤵
PID:3516

C:\Windows\ukcxhdohuhpbvvue.exe
ukcxhdohuhpbvvue.exe
1⤵
PID:1960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe .
1⤵
PID:3560

C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5680
- C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
  "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
  2⤵
  PID:5556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icyxllaxofrhfjmaciey.exe
1⤵
PID:2292
- C:\Windows\icyxllaxofrhfjmaciey.exe
  icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe .
1⤵
PID:4292
- C:\Windows\xsppefvtldqhglpeholgd.exe
  xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:5732

C:\Windows\bslhspbvjxgtoppaz.exe
bslhspbvjxgtoppaz.exe
1⤵
PID:1108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:3220
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5008
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:1280

C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
C:\Users\Admin\AppData\Local\Temp\ukcxhdohuhpbvvue.exe
1⤵
PID:5912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:3716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:3376
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:5196
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4792
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe
1⤵
PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4272
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:2516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:920
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:3956
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:2372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
1⤵
PID:5848
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe .
  2⤵
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:3788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:2888
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe
  2⤵
  PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:4232
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:5932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:4948
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe .
  2⤵
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\bslhspbvjxgtoppaz.exe*."
    3⤵
    PID:1192

C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
1⤵
PID:5396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:3992
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:2708
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:1836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4852
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:1164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:2360
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:5268
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:5108
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ukcxhdohuhpbvvue.exe .
1⤵
PID:2760
- C:\Windows\ukcxhdohuhpbvvue.exe
  ukcxhdohuhpbvvue.exe .
  2⤵
  PID:1496

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe
1⤵
PID:5676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe .
1⤵
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
1⤵
PID:5008
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  2⤵
  PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
1⤵
PID:4632
- C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe
  C:\Users\Admin\AppData\Local\Temp\xsppefvtldqhglpeholgd.exe .
  2⤵
  PID:6024
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\xsppefvtldqhglpeholgd.exe*."
    3⤵
    PID:3440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  C:\Users\Admin\AppData\Local\Temp\bslhspbvjxgtoppaz.exe
  2⤵
  PID:4064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4812
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c bslhspbvjxgtoppaz.exe
1⤵
PID:2620
- C:\Windows\bslhspbvjxgtoppaz.exe
  bslhspbvjxgtoppaz.exe
  2⤵
  PID:1808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:4256
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:1888
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:4392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c vojhuthdtjujgjlyzez.exe .
1⤵
PID:4052
- C:\Windows\vojhuthdtjujgjlyzez.exe
  vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\vojhuthdtjujgjlyzez.exe*."
    3⤵
    PID:4984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:4712
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:3272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
1⤵
PID:840
- C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe
  C:\Users\Admin\AppData\Local\Temp\kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:1520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
1⤵
PID:1692
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  2⤵
  PID:2984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
1⤵
PID:5244
- C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe
  C:\Users\Admin\AppData\Local\Temp\icyxllaxofrhfjmaciey.exe .
  2⤵
  PID:2604
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\users\admin\appdata\local\temp\icyxllaxofrhfjmaciey.exe*."
    3⤵
    PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe
1⤵
PID:3896
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe
  2⤵
  PID:2952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:5860
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c xsppefvtldqhglpeholgd.exe
1⤵
PID:3772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c kcwtfdqlapznjlmyyc.exe .
1⤵
PID:1004
- C:\Windows\kcwtfdqlapznjlmyyc.exe
  kcwtfdqlapznjlmyyc.exe .
  2⤵
  PID:4484
- - C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe
    "C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe" "c:\windows\kcwtfdqlapznjlmyyc.exe*."
    3⤵
    PID:2704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
1⤵
PID:4588
- C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe
  C:\Users\Admin\AppData\Local\Temp\vojhuthdtjujgjlyzez.exe .
  2⤵
  PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\xcjtsddlnpmnwlzylcjovfeppxz.yzi

Filesize
272B

MD5
61d0d939b7495f08e09109442272126d

SHA1
6e7b4d1c5e8d539b9cee401fc0fd6b5ac8a72cdd

SHA256
6d58d7205b8a49b2d10c56e015d730683aa994def1319f102e8708c9cdd3b0a7

SHA512
e3462a88407d1a55e2dfb22519deb1a5da124b33760f3d20d1f7f08070354fd0f556bb80b8896b17eb14c5313900baa9c23563e0b64296031a58ac867e8866c2

Download Submit
C:\Program Files (x86)\xcjtsddlnpmnwlzylcjovfeppxz.yzi

Filesize
272B

MD5
d3914059923995fa87273ab15277b0aa

SHA1
2ea0c4d45a8cf1478ed30cafec58df83e15cd43b

SHA256
90b5f366ce49a4eb9502fcd7a7b73cd597ecdd7e02a6a11052458c8a3af893e3

SHA512
239e216c3906db5ce704d93631e2c2151081ee2794d67b380ec0c19d9acbfaf2c2c4f501e794ad4c8f6d289de34a86ea45d6ca45dcf5c66cc970d0df0fac5186

Download Submit
C:\Users\Admin\AppData\Local\Temp\gncxrwpmqxm.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\iowhht.exe

Filesize
692KB

MD5
c507969d91f757c1b03f7066e763834c

SHA1
f509c467e8bdd330ddaf886ff05a4c2dedcba852

SHA256
ded52f64d02935e69ef6ec3215a1bd2a91a1487922d88e6a4847813e1fc5467d

SHA512
ad758dd2d193757865bef5382edca72014c6cd9a73b9daccf46b32f5e967cc540188fa5d61c3bc1b7a11ae6d76e2b001a7648c6042eed045c711a50e699165a6

Download Submit
C:\Users\Admin\AppData\Local\ukcxhdohuhpbvvuecewmezjfqjwjrdxxwgegyo.blh

Filesize
3KB

MD5
a0f364d6092a9654896c3950b709f39a

SHA1
692ac6e86a68d766c25673e01544384c3769d8bd

SHA256
556057f5d6a963337910f110270275ddc841d0343669efb77b33c53b069425a8

SHA512
60a86562513eca8b4ef149a63790f9096768df32cbacb542370c9920825b01b9593987133ac839874da8507c687642ff755943b78c8e087c4ff6aa3c9ea23746

Download Submit
C:\Users\Admin\AppData\Local\xcjtsddlnpmnwlzylcjovfeppxz.yzi

Filesize
272B

MD5
cd662dca04ee1c9f22f52ea0baab807d

SHA1
006cfe93e5489cb536faa8fc680b97aaede6e8b9

SHA256
6a5672fb371ba80cebf75ff86fb777e7a49bd3697aa39666c654e4039ed69cc6

SHA512
d8f548073830050a68be0aee424d1e5799951e7d1743212515eec6611c7273ac343b25065083c7d1ff196c6d6e0717855e6ac59fa19e50ea146d465dccb1add0

Download Submit
C:\Users\Admin\AppData\Local\xcjtsddlnpmnwlzylcjovfeppxz.yzi

Filesize
272B

MD5
6f5f3613213b0e7f1b6aea1d8284c8f2

SHA1
041e886710ae64e64521b279cb9a179ec50237bb

SHA256
f082c9a9791d2c62ddd1c3ea67201e2bc287c21ad897945424294741d142ac40

SHA512
d446ed60620d9ce86c4c241c73267123d947cf803dcb65f97d41e850456244264fdb6d2dbe3dd0eea9d19d326f829e1f01c4419f3b120c9dceb9e1bd0ca280f9

Download Submit
C:\Windows\SysWOW64\kcwtfdqlapznjlmyyc.exe

Filesize
492KB

MD5
95740da3398074068a3996678d1bd6ab

SHA1
de012d8f2e88279034b24544e88df79b500234e7

SHA256
fba54a1e535fd297b65592dfcdf1fb54a75af0a4e496d924ea15eac85eec1a2e

SHA512
cfac8aec23668a899e878bdc133475567b55fe4dfae735356f0756927fdf324380f74982cad2d64f69c4ef0894b8bd9d7b74c1e884298170ed3df103ac13eaa2

Download Submit