glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AacbS3OaQCct4_c3CgtLIjVh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AacbS3OaQCct4_c3CgtLIjVh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c00gQ3HJJ2XJua9C_ieOqvJI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c00gQ3HJJ2XJua9C_ieOqvJI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ySwJ90pAt07ElMKtbySn3i_S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ySwJ90pAt07ElMKtbySn3i_S.exe

Loads dropped DLL 3 IoCs

pid	Process
4164	howZgMe2M1KQeEQZ6ENBvKp5.tmp
4164	howZgMe2M1KQeEQZ6ENBvKp5.tmp
840	Nn2nUNMEATfgxSi1Nn61gdXd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral19/files/0x000100000002b1d8-235.dat	themida
behavioral19/memory/3244-296-0x00000000006D0000-0x00000000006D1000-memory.dmp	themida
behavioral19/files/0x000100000002b1c6-254.dat	themida
behavioral19/files/0x000100000002b1d4-249.dat	themida
behavioral19/files/0x000100000002b1d8-170.dat	themida
behavioral19/files/0x000100000002b1d4-194.dat	themida
behavioral19/files/0x000100000002b1c6-175.dat	themida
behavioral19/memory/888-318-0x0000000000890000-0x0000000000891000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AacbS3OaQCct4_c3CgtLIjVh.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c00gQ3HJJ2XJua9C_ieOqvJI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ySwJ90pAt07ElMKtbySn3i_S.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
107	ipinfo.io
35	ipinfo.io
58	ipinfo.io
59	ipinfo.io
103	ipinfo.io
175	ipinfo.io
824	ipinfo.io
1983	ipinfo.io
3	ipinfo.io
59	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3244	AacbS3OaQCct4_c3CgtLIjVh.exe
888	c00gQ3HJJ2XJua9C_ieOqvJI.exe
1524	ySwJ90pAt07ElMKtbySn3i_S.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 1032	1536	HEJz1J1Rb5I0yytRHbheQrVJ.exe	107
PID 1020 set thread context of 4464	1020	LdA4VG1Dl7ojrm8cmKqcnkPG.exe	116
PID 1100 set thread context of 4728	1100	_Ttf21tvf4SPGCuDVI1nNIci.exe	117
PID 1288 set thread context of 4928	1288	vcq_hg7YU9eSkHzq1HejVvWt.exe	120
PID 1200 set thread context of 4232	1200	6Ar0nOaMaTNELleHDFzpn1wX.exe	132
PID 1100 set thread context of 2512	1100	_Ttf21tvf4SPGCuDVI1nNIci.exe	140

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	xMCV5EElwPy7Rks7LvcCmWnd.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	nKz02n4usTjNM7b2rWKxOQiM.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	nKz02n4usTjNM7b2rWKxOQiM.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	xMCV5EElwPy7Rks7LvcCmWnd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	xMCV5EElwPy7Rks7LvcCmWnd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	xMCV5EElwPy7Rks7LvcCmWnd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	xMCV5EElwPy7Rks7LvcCmWnd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
3516	732	WerFault.exe	94
4092	1344	WerFault.exe	84
1188	1196	WerFault.exe	87
4564	1152	WerFault.exe	88
6140	5940	WerFault.exe
404	5488	WerFault.exe	169
5940	6832	WerFault.exe	264
7752	6832	WerFault.exe	264
5204	7284	WerFault.exe	255
9072	3472	WerFault.exe	252
8144	4308	WerFault.exe	142
968	2600	WerFault.exe	110
10052	10592	WerFault.exe	367
9592	10764	WerFault.exe	394
5188	2808	WerFault.exe	415

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HEJz1J1Rb5I0yytRHbheQrVJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HEJz1J1Rb5I0yytRHbheQrVJ.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HEJz1J1Rb5I0yytRHbheQrVJ.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	LdA4VG1Dl7ojrm8cmKqcnkPG.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
940	schtasks.exe
4024	schtasks.exe
12948	schtasks.exe
2868	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6948	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	LdA4VG1Dl7ojrm8cmKqcnkPG.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
508	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\	Process not Found

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6656	PING.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	105	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	117	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	168	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	275	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4876	Setup (26).exe
4876	Setup (26).exe
1032	HEJz1J1Rb5I0yytRHbheQrVJ.exe
1032	HEJz1J1Rb5I0yytRHbheQrVJ.exe
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
4092	WerFault.exe
4092	WerFault.exe
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
3208	Process not Found
1188	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
1188	LdA4VG1Dl7ojrm8cmKqcnkPG.exe
3208	Process not Found
3208	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1032	HEJz1J1Rb5I0yytRHbheQrVJ.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	440	k9d1aarOnyLszRBoIaxkg4X9.exe
Token: SeDebugPrivilege	976	C4vLIDkxDW9HeMHKJ5Rwi6t5.exe
Token: SeRestorePrivilege	3516	WerFault.exe
Token: SeBackupPrivilege	3516	WerFault.exe
Token: SeRestorePrivilege	4092	WerFault.exe
Token: SeBackupPrivilege	4092	WerFault.exe
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found
Token: SeShutdownPrivilege	3208	Process not Found
Token: SeCreatePagefilePrivilege	3208	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4164	howZgMe2M1KQeEQZ6ENBvKp5.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3244	4876	Setup (26).exe	102
PID 4876 wrote to memory of 3244	4876	Setup (26).exe	102
PID 4876 wrote to memory of 3244	4876	Setup (26).exe	102
PID 4876 wrote to memory of 1536	4876	Setup (26).exe	80
PID 4876 wrote to memory of 1536	4876	Setup (26).exe	80
PID 4876 wrote to memory of 1536	4876	Setup (26).exe	80
PID 4876 wrote to memory of 1524	4876	Setup (26).exe	81
PID 4876 wrote to memory of 1524	4876	Setup (26).exe	81
PID 4876 wrote to memory of 1524	4876	Setup (26).exe	81
PID 4876 wrote to memory of 1372	4876	Setup (26).exe	83
PID 4876 wrote to memory of 1372	4876	Setup (26).exe	83
PID 4876 wrote to memory of 1372	4876	Setup (26).exe	83
PID 4876 wrote to memory of 1344	4876	Setup (26).exe	84
PID 4876 wrote to memory of 1344	4876	Setup (26).exe	84
PID 4876 wrote to memory of 1344	4876	Setup (26).exe	84
PID 4876 wrote to memory of 1288	4876	Setup (26).exe	85
PID 4876 wrote to memory of 1288	4876	Setup (26).exe	85
PID 4876 wrote to memory of 1288	4876	Setup (26).exe	85
PID 4876 wrote to memory of 1492	4876	Setup (26).exe	82
PID 4876 wrote to memory of 1492	4876	Setup (26).exe	82
PID 4876 wrote to memory of 1492	4876	Setup (26).exe	82
PID 4876 wrote to memory of 3200	4876	Setup (26).exe	101
PID 4876 wrote to memory of 3200	4876	Setup (26).exe	101
PID 4876 wrote to memory of 3200	4876	Setup (26).exe	101
PID 4876 wrote to memory of 1200	4876	Setup (26).exe	86
PID 4876 wrote to memory of 1200	4876	Setup (26).exe	86
PID 4876 wrote to memory of 1200	4876	Setup (26).exe	86
PID 4876 wrote to memory of 1196	4876	Setup (26).exe	87
PID 4876 wrote to memory of 1196	4876	Setup (26).exe	87
PID 4876 wrote to memory of 1196	4876	Setup (26).exe	87
PID 4876 wrote to memory of 1152	4876	Setup (26).exe	88
PID 4876 wrote to memory of 1152	4876	Setup (26).exe	88
PID 4876 wrote to memory of 1152	4876	Setup (26).exe	88
PID 4876 wrote to memory of 1100	4876	Setup (26).exe	89
PID 4876 wrote to memory of 1100	4876	Setup (26).exe	89
PID 4876 wrote to memory of 1100	4876	Setup (26).exe	89
PID 4876 wrote to memory of 1096	4876	Setup (26).exe	90
PID 4876 wrote to memory of 1096	4876	Setup (26).exe	90
PID 4876 wrote to memory of 1096	4876	Setup (26).exe	90
PID 4876 wrote to memory of 732	4876	Setup (26).exe	94
PID 4876 wrote to memory of 732	4876	Setup (26).exe	94
PID 4876 wrote to memory of 732	4876	Setup (26).exe	94
PID 4876 wrote to memory of 344	4876	Setup (26).exe	96
PID 4876 wrote to memory of 344	4876	Setup (26).exe	96
PID 4876 wrote to memory of 344	4876	Setup (26).exe	96
PID 4876 wrote to memory of 840	4876	Setup (26).exe	100
PID 4876 wrote to memory of 840	4876	Setup (26).exe	100
PID 4876 wrote to memory of 840	4876	Setup (26).exe	100
PID 4876 wrote to memory of 888	4876	Setup (26).exe	98
PID 4876 wrote to memory of 888	4876	Setup (26).exe	98
PID 4876 wrote to memory of 888	4876	Setup (26).exe	98
PID 4876 wrote to memory of 972	4876	Setup (26).exe	97
PID 4876 wrote to memory of 972	4876	Setup (26).exe	97
PID 4876 wrote to memory of 972	4876	Setup (26).exe	97
PID 4876 wrote to memory of 440	4876	Setup (26).exe	91
PID 4876 wrote to memory of 440	4876	Setup (26).exe	91
PID 4876 wrote to memory of 480	4876	Setup (26).exe	95
PID 4876 wrote to memory of 480	4876	Setup (26).exe	95
PID 4876 wrote to memory of 480	4876	Setup (26).exe	95
PID 4876 wrote to memory of 976	4876	Setup (26).exe	92
PID 4876 wrote to memory of 976	4876	Setup (26).exe	92
PID 4876 wrote to memory of 1020	4876	Setup (26).exe	99
PID 4876 wrote to memory of 1020	4876	Setup (26).exe	99
PID 4876 wrote to memory of 1020	4876	Setup (26).exe	99

C:\Users\Admin\AppData\Local\Temp\Setup (26).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (26).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\Documents\HEJz1J1Rb5I0yytRHbheQrVJ.exe
  "C:\Users\Admin\Documents\HEJz1J1Rb5I0yytRHbheQrVJ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1536
- - C:\Users\Admin\Documents\HEJz1J1Rb5I0yytRHbheQrVJ.exe
    "C:\Users\Admin\Documents\HEJz1J1Rb5I0yytRHbheQrVJ.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1032
- C:\Users\Admin\Documents\ySwJ90pAt07ElMKtbySn3i_S.exe
  "C:\Users\Admin\Documents\ySwJ90pAt07ElMKtbySn3i_S.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1524
- C:\Users\Admin\Documents\xMCV5EElwPy7Rks7LvcCmWnd.exe
  "C:\Users\Admin\Documents\xMCV5EElwPy7Rks7LvcCmWnd.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1492
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Executes dropped EXE
    PID:1940
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4872
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    - Executes dropped EXE
    PID:3432
- C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe
  "C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe"
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe
    "C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe"
    3⤵
    PID:5940
- - C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe
    "C:\Users\Admin\Documents\1VnexS_MVX5Xy6hEouShyewx.exe"
    3⤵
    PID:3472
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 1304
      4⤵
      Program crash
      PID:9072
- C:\Users\Admin\Documents\oyd5OUxmBfGWovoxsWiRrDQr.exe
  "C:\Users\Admin\Documents\oyd5OUxmBfGWovoxsWiRrDQr.exe"
  2⤵
  - Executes dropped EXE
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 280
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
  "C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1288
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    - Executes dropped EXE
    PID:4928
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:2276
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:4752
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5276
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5000
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5852
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5904
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5876
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:6004
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5408
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5172
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:6516
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5444
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:7016
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:6496
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:7104
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:3316
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:4528
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:2840
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:132
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:8120
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:3008
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:4420
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:8084
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:1996
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:3396
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:7900
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:1560
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:2636
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:8332
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:7604
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5424
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:9164
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:10900
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:5992
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:10592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10592 -s 28
      4⤵
      Program crash
      PID:10052
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:11620
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:9912
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:8144
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:12616
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:8952
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:9324
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:7600
- - C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    C:\Users\Admin\Documents\vcq_hg7YU9eSkHzq1HejVvWt.exe
    3⤵
    PID:10844
- C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
  "C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1200
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    - Executes dropped EXE
    PID:4232
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:2348
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:4988
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5556
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6120
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5140
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5748
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5316
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:3828
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:4640
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6524
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7060
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6876
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:2532
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:4348
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7824
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6036
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:4352
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7988
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:3856
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7772
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5348
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:1968
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6048
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7328
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:1556
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:5540
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7736
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:2936
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:8344
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7680
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:9708
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:8532
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6296
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:10988
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:3556
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:8816
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:9968
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:11212
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:7048
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:11584
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:9152
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:10544
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:6200
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:13008
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:11904
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:10620
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:12656
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:11476
- - C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    C:\Users\Admin\Documents\6Ar0nOaMaTNELleHDFzpn1wX.exe
    3⤵
    PID:12516
- C:\Users\Admin\Documents\_zuDt5ZM_c5sDbtmlIDC2MbP.exe
  "C:\Users\Admin\Documents\_zuDt5ZM_c5sDbtmlIDC2MbP.exe"
  2⤵
  - Executes dropped EXE
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 280
    3⤵
    - Program crash
    PID:1188
- C:\Users\Admin\Documents\gTxDml2XZo6tvMP9TinTvcvE.exe
  "C:\Users\Admin\Documents\gTxDml2XZo6tvMP9TinTvcvE.exe"
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 240
    3⤵
    - Program crash
    PID:4564
- C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
  "C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1100
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    - Executes dropped EXE
    PID:4728
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:2512
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:4640
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:5520
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:2988
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:456
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:5916
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:4088
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3004
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6076
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6152
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3692
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:5132
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6644
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6400
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3476
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6292
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3716
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:2508
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3344
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:588
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:2892
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:8124
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:5600
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6136
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:9876
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:10644
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:3988
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6000
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:2560
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:9048
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:11848
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:5800
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:10552
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:6740
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:9232
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:12508
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:7760
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:7836
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:1464
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:7888
- - C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    C:\Users\Admin\Documents\_Ttf21tvf4SPGCuDVI1nNIci.exe
    3⤵
    PID:8652
- C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe
  "C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe"
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ("C:\Users\Admin\Documents\zbec6209OLnHbnIOxqy5bt2x.exe" ) do taskkill /iM "%~NXm" -F
      4⤵
      PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
        
        IQ0v_FE_.ExE -poRsuYEMryiLi
        5⤵
        Executes dropped EXE
        
        PID:5036
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe( CREAteobjecT ("wScRiPT.ShElL" ).RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if ""-poRsuYEMryiLi""== """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE"" ) do taskkill /iM ""%~NXm"" -F" ,0 , TRUE ))
        6⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if "-poRsuYEMryiLi"== "" for %m in ("C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE" ) do taskkill /iM "%~NXm" -F
        7⤵
        
        PID:5776
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" VHTDDahA.G,XBvVyh
        6⤵
        
        PID:3140
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /iM "zbec6209OLnHbnIOxqy5bt2x.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:508
- C:\Users\Admin\Documents\k9d1aarOnyLszRBoIaxkg4X9.exe
  "C:\Users\Admin\Documents\k9d1aarOnyLszRBoIaxkg4X9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- - C:\Users\Admin\AppData\Roaming\8920155.exe
    "C:\Users\Admin\AppData\Roaming\8920155.exe"
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4308 -s 2344
      4⤵
      Program crash
      PID:8144
- - C:\Users\Admin\AppData\Roaming\2455843.exe
    "C:\Users\Admin\AppData\Roaming\2455843.exe"
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Roaming\2987917.exe
    "C:\Users\Admin\AppData\Roaming\2987917.exe"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Roaming\5029889.exe
    "C:\Users\Admin\AppData\Roaming\5029889.exe"
    3⤵
    PID:4188
- - C:\Users\Admin\AppData\Roaming\2692148.exe
    "C:\Users\Admin\AppData\Roaming\2692148.exe"
    3⤵
    PID:5368
- C:\Users\Admin\Documents\C4vLIDkxDW9HeMHKJ5Rwi6t5.exe
  "C:\Users\Admin\Documents\C4vLIDkxDW9HeMHKJ5Rwi6t5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Users\Admin\Documents\rVdWWN9HP4W1h3Xgb7oZziOC.exe
  "C:\Users\Admin\Documents\rVdWWN9HP4W1h3Xgb7oZziOC.exe"
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Users\Admin\Documents\mXniSSBspo_RbxkyJZGIrXf9.exe
  "C:\Users\Admin\Documents\mXniSSBspo_RbxkyJZGIrXf9.exe"
  2⤵
  - Executes dropped EXE
  PID:732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 276
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\Users\Admin\Documents\nKz02n4usTjNM7b2rWKxOQiM.exe
  "C:\Users\Admin\Documents\nKz02n4usTjNM7b2rWKxOQiM.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4024
- C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe
  "C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe"
  2⤵
  - Executes dropped EXE
  PID:344
- - C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe
    "C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe"
    3⤵
    PID:7072
- - C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe
    "C:\Users\Admin\Documents\lWP34u_ECv8HWLbTWVeJ0E7Z.exe"
    3⤵
    PID:2464
- C:\Users\Admin\Documents\J04g0DMhf82jdEDVufXojZTn.exe
  "C:\Users\Admin\Documents\J04g0DMhf82jdEDVufXojZTn.exe"
  2⤵
  - Executes dropped EXE
  PID:972
- - C:\Users\Admin\Documents\J04g0DMhf82jdEDVufXojZTn.exe
    "C:\Users\Admin\Documents\J04g0DMhf82jdEDVufXojZTn.exe" -u
    3⤵
    - Executes dropped EXE
    PID:3348
- C:\Users\Admin\Documents\c00gQ3HJJ2XJua9C_ieOqvJI.exe
  "C:\Users\Admin\Documents\c00gQ3HJJ2XJua9C_ieOqvJI.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:888
- C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
  "C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1020
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    - Executes dropped EXE
    PID:4464
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    - Executes dropped EXE
    PID:3636
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:940
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:5940
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:5280
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6088
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:5912
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:3612
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6244
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6816
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6236
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:864
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6240
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:508
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:6260
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:8056
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:4708
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:7540
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:4540
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:7676
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:8388
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:9728
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:8872
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:11060
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:11744
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:7000
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:11528
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:11064
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:8540
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:8828
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:10424
- - C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    C:\Users\Admin\Documents\LdA4VG1Dl7ojrm8cmKqcnkPG.exe
    3⤵
    PID:12860
- C:\Users\Admin\Documents\Nn2nUNMEATfgxSi1Nn61gdXd.exe
  "C:\Users\Admin\Documents\Nn2nUNMEATfgxSi1Nn61gdXd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\Nn2nUNMEATfgxSi1Nn61gdXd.exe"
    3⤵
    PID:6344
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:6948
- C:\Users\Admin\Documents\mERzv94TTMUhnm7K941VQv08.exe
  "C:\Users\Admin\Documents\mERzv94TTMUhnm7K941VQv08.exe"
  2⤵
  - Executes dropped EXE
  PID:3200
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KBAvfsr.exe"
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 280
      4⤵
      Program crash
      PID:968
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FkDS8ej.exe"
    3⤵
    PID:4372
- C:\Users\Admin\Documents\AacbS3OaQCct4_c3CgtLIjVh.exe
  "C:\Users\Admin\Documents\AacbS3OaQCct4_c3CgtLIjVh.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3244
- C:\Users\Admin\Documents\howZgMe2M1KQeEQZ6ENBvKp5.exe
  "C:\Users\Admin\Documents\howZgMe2M1KQeEQZ6ENBvKp5.exe"
  2⤵
  - Executes dropped EXE
  PID:4632

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 8PFJ7Xr/RkiQhw851r/usQ.0.2
1⤵
- Modifies data under HKEY_USERS
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1344 -ip 1344
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2288

C:\Users\Admin\AppData\Local\Temp\is-3O19Q.tmp\howZgMe2M1KQeEQZ6ENBvKp5.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3O19Q.tmp\howZgMe2M1KQeEQZ6ENBvKp5.tmp" /SL5="$102F0,138429,56832,C:\Users\Admin\Documents\howZgMe2M1KQeEQZ6ENBvKp5.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4164
- C:\Users\Admin\AppData\Local\Temp\is-F98TF.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-F98TF.tmp\Setup.exe" /Verysilent
  2⤵
  PID:3612
- - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
    3⤵
    PID:2208
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:6436
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:6364
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:3320
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:1432
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:7952
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:4108
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:7940
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:5196
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:5088
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:6472
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:6180
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:8960
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:8788
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:8624
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:4116
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:4164
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:9124
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:11072
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:8724
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:7716
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:12208
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:10688
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:9276
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:12880
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:11820
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:11376
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\Spadille.exe"
      4⤵
      PID:2960
- - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
    3⤵
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\is-5LN2A.tmp\stats.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5LN2A.tmp\stats.tmp" /SL5="$40298,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
      4⤵
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\is-KK66B.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KK66B.tmp\Setup.exe" /Verysilent
        5⤵
        
        PID:1536
      - C:\Users\Admin\Documents\rlz3UKnzkgg5Va4Qwp9dKG8_.exe
        
        "C:\Users\Admin\Documents\rlz3UKnzkgg5Va4Qwp9dKG8_.exe"
        6⤵
        
        PID:3184
        
        C:\Users\Admin\Documents\rlz3UKnzkgg5Va4Qwp9dKG8_.exe
        
        C:\Users\Admin\Documents\rlz3UKnzkgg5Va4Qwp9dKG8_.exe
        7⤵
        
        PID:10640
      - C:\Users\Admin\Documents\Le9Y1vrBF4xVUMObHjuIOC0f.exe
        
        "C:\Users\Admin\Documents\Le9Y1vrBF4xVUMObHjuIOC0f.exe"
        6⤵
        
        PID:9372
      - C:\Users\Admin\Documents\f0kHFZL_sFfkczF_Z2v2EA53.exe
        
        "C:\Users\Admin\Documents\f0kHFZL_sFfkczF_Z2v2EA53.exe"
        6⤵
        
        PID:7024
      - C:\Users\Admin\Documents\5gvxI4rRxOCQNUFICWss0xqy.exe
        
        "C:\Users\Admin\Documents\5gvxI4rRxOCQNUFICWss0xqy.exe"
        6⤵
        
        PID:2600
      - C:\Users\Admin\Documents\JXEfnDOfb1n5M5f35GxgBgxM.exe
        
        "C:\Users\Admin\Documents\JXEfnDOfb1n5M5f35GxgBgxM.exe"
        6⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10764 -s 276
        7⤵
        Program crash
        
        PID:9592
      - C:\Users\Admin\Documents\Ny9ddJA7MIMvMaB2fqVpH0Jn.exe
        
        "C:\Users\Admin\Documents\Ny9ddJA7MIMvMaB2fqVpH0Jn.exe"
        6⤵
        
        PID:5900
        
        C:\Users\Admin\Documents\Ny9ddJA7MIMvMaB2fqVpH0Jn.exe
        
        C:\Users\Admin\Documents\Ny9ddJA7MIMvMaB2fqVpH0Jn.exe
        7⤵
        
        PID:9228
      - C:\Users\Admin\Documents\FXYsvK0s3XxR8z7rLcfE9H59.exe
        
        "C:\Users\Admin\Documents\FXYsvK0s3XxR8z7rLcfE9H59.exe"
        6⤵
        
        PID:5396
      - C:\Users\Admin\Documents\lrRoQlot3khIk6WWYFK_4tQm.exe
        
        "C:\Users\Admin\Documents\lrRoQlot3khIk6WWYFK_4tQm.exe"
        6⤵
        
        PID:2616
      - C:\Users\Admin\Documents\JXhV_u0vIUW1llCj_yxc939V.exe
        
        "C:\Users\Admin\Documents\JXhV_u0vIUW1llCj_yxc939V.exe"
        6⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:12948
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:2868
      - C:\Users\Admin\Documents\qYBoKN144PbJ8LujMuLsyLSl.exe
        
        "C:\Users\Admin\Documents\qYBoKN144PbJ8LujMuLsyLSl.exe"
        6⤵
        
        PID:4548
      - C:\Users\Admin\Documents\1lnbfR6J6SuTABeIQG1yCOxI.exe
        
        "C:\Users\Admin\Documents\1lnbfR6J6SuTABeIQG1yCOxI.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\Documents\VpHOvT25VrIqkPwoHT_vXIcP.exe
        
        "C:\Users\Admin\Documents\VpHOvT25VrIqkPwoHT_vXIcP.exe"
        6⤵
        
        PID:808
      - C:\Users\Admin\Documents\fx0zFVIs1l4835KPVTVjlxXP.exe
        
        "C:\Users\Admin\Documents\fx0zFVIs1l4835KPVTVjlxXP.exe"
        6⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\is-ABPQM.tmp\fx0zFVIs1l4835KPVTVjlxXP.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ABPQM.tmp\fx0zFVIs1l4835KPVTVjlxXP.tmp" /SL5="$1050E,138429,56832,C:\Users\Admin\Documents\fx0zFVIs1l4835KPVTVjlxXP.exe"
        7⤵
        
        PID:4612
      - C:\Users\Admin\Documents\RrmkKELSf5hmoizzWRp1tqq2.exe
        
        "C:\Users\Admin\Documents\RrmkKELSf5hmoizzWRp1tqq2.exe"
        6⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 276
        7⤵
        Program crash
        
        PID:5188
      - C:\Users\Admin\Documents\CtSmn8R5h_meO8O641YgYkBu.exe
        
        "C:\Users\Admin\Documents\CtSmn8R5h_meO8O641YgYkBu.exe"
        6⤵
        
        PID:10996
        
        C:\Users\Admin\Documents\CtSmn8R5h_meO8O641YgYkBu.exe
        
        "C:\Users\Admin\Documents\CtSmn8R5h_meO8O641YgYkBu.exe"
        7⤵
        
        PID:12336
      - C:\Users\Admin\Documents\8WpAN9gdaOBNS9Ja34QxGskK.exe
        
        "C:\Users\Admin\Documents\8WpAN9gdaOBNS9Ja34QxGskK.exe"
        6⤵
        
        PID:8816
      - C:\Users\Admin\Documents\uylqT_MVzJZF07FZ0d4mvZ7F.exe
        
        "C:\Users\Admin\Documents\uylqT_MVzJZF07FZ0d4mvZ7F.exe"
        6⤵
        
        PID:1216
      - C:\Users\Admin\Documents\fbJ9beoiA4ZkoEmz_WCXDkdb.exe
        
        "C:\Users\Admin\Documents\fbJ9beoiA4ZkoEmz_WCXDkdb.exe"
        6⤵
        
        PID:5352
      - C:\Users\Admin\Documents\EdMvvvCvSVPbRvNNs18Bo0Bq.exe
        
        "C:\Users\Admin\Documents\EdMvvvCvSVPbRvNNs18Bo0Bq.exe"
        6⤵
        
        PID:3308
        
        C:\Users\Admin\Documents\EdMvvvCvSVPbRvNNs18Bo0Bq.exe
        
        C:\Users\Admin\Documents\EdMvvvCvSVPbRvNNs18Bo0Bq.exe
        7⤵
        
        PID:11872
      - C:\Users\Admin\Documents\ocDh5uc2rk1S4_lv8Beim_Su.exe
        
        "C:\Users\Admin\Documents\ocDh5uc2rk1S4_lv8Beim_Su.exe"
        6⤵
        
        PID:10380
      - C:\Users\Admin\Documents\uFWCCaM0AsIkGHdUhQBFkhjR.exe
        
        "C:\Users\Admin\Documents\uFWCCaM0AsIkGHdUhQBFkhjR.exe"
        6⤵
        
        PID:8900
      - C:\Users\Admin\Documents\WLfALw1UBFpMWxScJBzSKRdE.exe
        
        "C:\Users\Admin\Documents\WLfALw1UBFpMWxScJBzSKRdE.exe"
        6⤵
        
        PID:4192
      - C:\Users\Admin\Documents\Id4qcvgudvzDu7a0S0M0HQW1.exe
        
        "C:\Users\Admin\Documents\Id4qcvgudvzDu7a0S0M0HQW1.exe"
        6⤵
        
        PID:11992
- - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
    3⤵
    PID:2836
- - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
    3⤵
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\tmpB97D_tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpB97D_tmp.exe"
      4⤵
      PID:7548
    - - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        5⤵
        
        PID:8084
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Pei.xll
        5⤵
        
        PID:992
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll
        7⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        7⤵
        Runs ping.exe
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        Tra.exe.com o
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        8⤵
        
        PID:11876
- - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
    3⤵
    PID:988
  - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
      "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a
      4⤵
      PID:6440
- - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Roaming\1241857.exe
      "C:\Users\Admin\AppData\Roaming\1241857.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Roaming\3799692.exe
      "C:\Users\Admin\AppData\Roaming\3799692.exe"
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Roaming\2483471.exe
      "C:\Users\Admin\AppData\Roaming\2483471.exe"
      4⤵
      PID:2240
  - - C:\Users\Admin\AppData\Roaming\7090681.exe
      "C:\Users\Admin\AppData\Roaming\7090681.exe"
      4⤵
      PID:1204
  - - C:\Users\Admin\AppData\Roaming\1472742.exe
      "C:\Users\Admin\AppData\Roaming\1472742.exe"
      4⤵
      PID:1912
- - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
    3⤵
    PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1196 -ip 1196
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 732 -ip 732
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1152 -ip 1152
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5792

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 452
    3⤵
    - Program crash
    PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5488 -ip 5488
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 28
1⤵
- Program crash
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5940 -ip 5940
1⤵
PID:5664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5360

C:\Users\Admin\AppData\Local\Temp\6DE9.exe
C:\Users\Admin\AppData\Local\Temp\6DE9.exe
1⤵
PID:7284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 276
  2⤵
  - Program crash
  PID:5204

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:8184
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 456
    3⤵
    - Program crash
    PID:5940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6832 -s 456
    3⤵
    - Program crash
    PID:7752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6832 -ip 6832
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7284 -ip 7284
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8084 -ip 8084
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10592 -ip 10592
1⤵
PID:11864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 10764 -ip 10764
1⤵
PID:10144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2808 -ip 2808
1⤵
PID:8752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2960 -ip 2960
1⤵
PID:13180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery