9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
Size 296KB
Sample241115-qdr79svaph
SHA256 9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0
MD5 2d96e4c716eb0cf915026ed8a7d01af0
SHA1 8d793f2ec2b319b9ab4d7d6f12275d15c4c73f88
SHA512 560a5dd1621a1be6ed93203378d5170831364d551c13a7288d558832c65e74b13c6372205d8cb32d1256a5fbe5202c43e2d18416c63a2fdd62a12021b8eb2e18
SSDEEP 3072:ejF3EAH9Z1IibJjCuS+Cu8au2cippFwPLjm2E3DkV+TJUDmKtfF7G+mbuAspFNmw:chH9Z1Ii5Cu025uL62EIEVCthblJ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (6363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Possible privilege escalation attempt 64 IoCs

exploit

pid	Process
1980	icacls.exe
5928	takeown.exe
5452	icacls.exe
4000	takeown.exe
2244	icacls.exe
4356	takeown.exe
1688	icacls.exe
5648	takeown.exe
5640	icacls.exe
2732	takeown.exe
2416	takeown.exe
3416	takeown.exe
3432	icacls.exe
5628	takeown.exe
1976	takeown.exe
5924	icacls.exe
5184	icacls.exe
5760	icacls.exe
4180	takeown.exe
5716	icacls.exe
5856	icacls.exe
1512	takeown.exe
1176	takeown.exe
112	icacls.exe
1592	takeown.exe
4748	takeown.exe
5752	icacls.exe
5608	icacls.exe
1468	takeown.exe
3948	takeown.exe
5040	takeown.exe
6036	icacls.exe
2672	takeown.exe
2480	icacls.exe
5848	takeown.exe
5400	icacls.exe
5876	takeown.exe
3176	icacls.exe
6012	icacls.exe
2600	icacls.exe
404	icacls.exe
3856	takeown.exe
5752	takeown.exe
2228	icacls.exe
3268	takeown.exe
5144	icacls.exe
5256	icacls.exe
2700	icacls.exe
2604	takeown.exe
1868	icacls.exe
1260	takeown.exe
5212	takeown.exe
5552	takeown.exe
5180	takeown.exe
3860	icacls.exe
5736	takeown.exe
5108	takeown.exe
2928	icacls.exe
3828	icacls.exe
3244	icacls.exe
5824	takeown.exe
5764	icacls.exe
4956	icacls.exe
1420	icacls.exe

Sets service image path in registry 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TieringEngineService\ImagePath = "C:\\Windows\\system32\\TieringEngineService.exe"	CENBJ0~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Fax\ImagePath = "C:\\Windows\\system32\\fxssvc.exe"	RXJIZ9~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeElevationService\ImagePath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\elevation_service.exe\""	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wmiApSrv\ImagePath = "C:\\Windows\\system32\\wbem\\WmiApSrv.exe"	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vds\ImagePath = "C:\\Windows\\System32\\vds.exe"	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SgrmBroker\ImagePath = "C:\\Windows\\system32\\SgrmBroker.exe"	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wmiApSrv\ImagePath = "C:\\Windows\\system32\\wbem\\WmiApSrv.exe"	CENBJ0~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\ImagePath = "C:\\Windows\\system32\\vssvc.exe"	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ClickToRunSvc\ImagePath = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe\""	WVMDNK~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RpcLocator\ImagePath = "C:\\Windows\\system32\\locator.exe"	CENBJ0~1:bin
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ALG\ImagePath = "C:\\Windows\\System32\\alg.exe"	CENBJ0~1:bin

Windows Defender anti-emulation file check 1 TTPs 12 IoCs

Defender's emulator always creates certain fake files which can be used to detect it.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\aaa_TouchMeNot_.txt	WVMDNK~1:bin
File opened (read-only)	C:\aaa_TouchMeNot_.txt	elevation_service.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	WmiApSrv.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	vds.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	CENBJ0~1:bin
File opened (read-only)	C:\aaa_TouchMeNot_.txt	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	RXJIZ9~1:bin
File opened (read-only)	C:\aaa_TouchMeNot_.txt	fxssvc.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	63SRPB~1:bin
File opened (read-only)	C:\aaa_TouchMeNot_.txt	fxssvc.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	locator.exe
File opened (read-only)	C:\aaa_TouchMeNot_.txt	alg.exe

Deletes itself 1 IoCs

pid	Process
2484	RXJIZ9~1:bin

Executes dropped EXE 12 IoCs

pid	Process
2484	RXJIZ9~1:bin
1968	fxssvc.exe
224	63SRPB~1:bin
3784	fxssvc.exe
3272	WVMDNK~1:bin
1932	elevation_service.exe
820	WmiApSrv.exe
1592	vds.exe
2772	CENBJ0~1:bin
4616	locator.exe
4460	alg.exe
4620	MPVWCO~1:bin

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5052	icacls.exe
5908	takeown.exe
5600	takeown.exe
2440	icacls.exe
4948	icacls.exe
5868	icacls.exe
5764	icacls.exe
6012	takeown.exe
404	icacls.exe
5792	icacls.exe
6140	icacls.exe
1960	takeown.exe
5532	takeown.exe
2672	takeown.exe
5580	icacls.exe
2376	takeown.exe
772	icacls.exe
2376	icacls.exe
4356	takeown.exe
300	icacls.exe
5500	icacls.exe
5316	icacls.exe
5640	icacls.exe
2700	icacls.exe
5400	icacls.exe
5536	icacls.exe
1500	icacls.exe
5276	icacls.exe
5340	icacls.exe
3520	takeown.exe
4888	icacls.exe
3708	takeown.exe
4980	icacls.exe
5724	takeown.exe
3772	takeown.exe
3948	takeown.exe
5864	icacls.exe
5992	icacls.exe
3244	takeown.exe
3304	takeown.exe
5104	icacls.exe
3248	takeown.exe
2224	takeown.exe
4000	takeown.exe
3244	icacls.exe
5876	takeown.exe
3208	icacls.exe
3900	takeown.exe
5600	icacls.exe
5584	takeown.exe
5724	takeown.exe
6052	takeown.exe
2612	icacls.exe
1660	takeown.exe
3384	icacls.exe
6132	icacls.exe
1976	icacls.exe
5760	icacls.exe
4360	icacls.exe
3804	icacls.exe
5328	takeown.exe
5804	icacls.exe
5060	takeown.exe
2024	icacls.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fxssvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WVMDNK~1:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vds.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CENBJ0~1:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	alg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fxssvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	63SRPB~1:bin
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	locator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RXJIZ9~1:bin

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	fxssvc.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3852	arp.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	WVMDNK~1:bin
File opened for modification	C:\Windows\system32\locator.exe	CENBJ0~1:bin
File opened for modification	C:\Windows\system32\TieringEngineService.exe	CENBJ0~1:bin
File created	C:\Windows\system32\fxssvc.exe:0	RXJIZ9~1:bin
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	WVMDNK~1:bin
File created	C:\Windows\System32\vds.exe:0	WVMDNK~1:bin
File created	C:\Windows\system32\TieringEngineService.exe:0	CENBJ0~1:bin
File opened for modification	C:\Windows\system32\vssvc.exe	WVMDNK~1:bin
File opened for modification	C:\Windows\System32\alg.exe	CENBJ0~1:bin
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	CENBJ0~1:bin
File created	C:\Windows\system32\SgrmBroker.exe:0	WVMDNK~1:bin
File created	C:\Windows\system32\locator.exe:0	CENBJ0~1:bin
File created	C:\Windows\System32\alg.exe:0	CENBJ0~1:bin
File opened for modification	C:\Windows\system32\fxssvc.exe	RXJIZ9~1:bin
File created	C:\Windows\system32\wbem\WmiApSrv.exe:0	WVMDNK~1:bin
File opened for modification	C:\Windows\System32\vds.exe	WVMDNK~1:bin

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\ui-strings.js.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js	fxssvc.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version	fxssvc.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]_readme	fxssvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.p0rr	fxssvc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\ui-strings.js.p0rr	fxssvc.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.p0rr_readme	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_hover_18.svg.p0rr_readme	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\PREVIEW.GIF.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat.p0rr	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\ui-strings.js.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.p0rr	fxssvc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\PSGet.Resource.psd1.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js.p0rr_readme	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\line.cur.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\Example2.Diagnostics.Tests.ps1	elevation_service.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.p0rr	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile.png.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ui-strings.js.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\PackageManagementDscUtilities.psm1.p0rr	fxssvc.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	elevation_service.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms	fxssvc.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.p0rr	fxssvc.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\EVRGREEN.INF	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\plugins.js.p0rr	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-tw\ui-strings.js	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\ui-strings.js.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MEIPreload\preloaded_data.pb	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\pt-PT.pak.DATA.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\ui-strings.js	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js.p0rr	fxssvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\TipTsf.dll.mui	fxssvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ui-strings.js	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr.pak.DATA.p0rr	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML	fxssvc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ADO210.CHM.p0rr	fxssvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaprsr.dll.mui	fxssvc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt.p0rr_readme	fxssvc.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	fxssvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif	fxssvc.exe

Program crash 21 IoCs

pid	pid_target	Process	procid_target
3736	1968	WerFault.exe	94
4736	3784	WerFault.exe	136
4492	1932	WerFault.exe	144
1456	820	WerFault.exe	150
404	1592	WerFault.exe	156
4248	4616	WerFault.exe	168
4392	4460	WerFault.exe	175
3680	336	WerFault.exe	181
5116	3604	WerFault.exe	193
4668	1308	WerFault.exe	205
3780	5000	WerFault.exe	207
3604	3080	WerFault.exe	221
336	1232	WerFault.exe	223
2360	3524	WerFault.exe	222
4852	3472	WerFault.exe	228
6084	4660	WerFault.exe	239
2568	3400	WerFault.exe	240
3252	1748	WerFault.exe	241
300	316	WerFault.exe	247
5228	1152	WerFault.exe	250
4920	4716	WerFault.exe	251

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elevation_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RXJIZ9~1:bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fxssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63SRPB~1:bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WVMDNK~1:bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WmiApSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CENBJ0~1:bin
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	locator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alg.exe

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
3204	net.exe
3056	net.exe
3324	net.exe

Interacts with shadow copies 3 TTPs 23 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1604	vssadmin.exe
4172	vssadmin.exe
4012	vssadmin.exe
4584	vssadmin.exe
5268	vssadmin.exe
5260	vssadmin.exe
3064	vssadmin.exe
3412	vssadmin.exe
2624	vssadmin.exe
5188	vssadmin.exe
3524	vssadmin.exe
1276	vssadmin.exe
4732	vssadmin.exe
304	vssadmin.exe
5544	vssadmin.exe
1172	vssadmin.exe
5076	vssadmin.exe
3028	vssadmin.exe
2912	vssadmin.exe
5056	vssadmin.exe
3256	vssadmin.exe
5156	vssadmin.exe
5828	vssadmin.exe

NTFS ADS 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\MPVWCO~1:bin	WmiApSrv.exe
File created	C:\Users\Admin\AppData\Roaming\RXJIZ9~1:bin	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
File created	C:\Users\Admin\AppData\Roaming\63SRPB~1:bin	fxssvc.exe
File created	C:\Users\Admin\AppData\Roaming\WVMDNK~1:bin	fxssvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe:0	WVMDNK~1:bin
File created	C:\Users\Admin\AppData\Roaming\CENBJ0~1:bin	elevation_service.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1968	fxssvc.exe
1968	fxssvc.exe
3784	fxssvc.exe
3784	fxssvc.exe
1932	elevation_service.exe
1932	elevation_service.exe
820	WmiApSrv.exe
820	WmiApSrv.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2216	takeown.exe
Token: SeBackupPrivilege	3044	vssvc.exe
Token: SeRestorePrivilege	3044	vssvc.exe
Token: SeAuditPrivilege	3044	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1968	fxssvc.exe
Token: SeAssignPrimaryTokenPrivilege	1968	fxssvc.exe
Token: SeIncreaseQuotaPrivilege	3784	fxssvc.exe
Token: SeAssignPrimaryTokenPrivilege	3784	fxssvc.exe
Token: SeTakeOwnershipPrivilege	3856	takeown.exe
Token: SeTakeOwnershipPrivilege	3444	takeown.exe
Token: SeIncreaseQuotaPrivilege	1932	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1932	elevation_service.exe
Token: SeTakeOwnershipPrivilege	2600	takeown.exe
Token: SeTakeOwnershipPrivilege	4172	takeown.exe
Token: SeTakeOwnershipPrivilege	1972	takeown.exe
Token: SeTakeOwnershipPrivilege	4640	takeown.exe
Token: SeIncreaseQuotaPrivilege	820	WmiApSrv.exe
Token: SeAssignPrimaryTokenPrivilege	820	WmiApSrv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2484	3868	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe	83
PID 3868 wrote to memory of 2484	3868	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe	83
PID 3868 wrote to memory of 2484	3868	9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe	83
PID 2484 wrote to memory of 1604	2484	RXJIZ9~1:bin	84
PID 2484 wrote to memory of 1604	2484	RXJIZ9~1:bin	84
PID 2484 wrote to memory of 2216	2484	RXJIZ9~1:bin	87
PID 2484 wrote to memory of 2216	2484	RXJIZ9~1:bin	87
PID 2484 wrote to memory of 4880	2484	RXJIZ9~1:bin	90
PID 2484 wrote to memory of 4880	2484	RXJIZ9~1:bin	90
PID 1968 wrote to memory of 224	1968	fxssvc.exe	95
PID 1968 wrote to memory of 224	1968	fxssvc.exe	95
PID 1968 wrote to memory of 224	1968	fxssvc.exe	95
PID 224 wrote to memory of 3524	224	63SRPB~1:bin	97
PID 224 wrote to memory of 3524	224	63SRPB~1:bin	97
PID 224 wrote to memory of 3852	224	63SRPB~1:bin	99
PID 224 wrote to memory of 3852	224	63SRPB~1:bin	99
PID 224 wrote to memory of 3856	224	63SRPB~1:bin	101
PID 224 wrote to memory of 3856	224	63SRPB~1:bin	101
PID 224 wrote to memory of 3512	224	63SRPB~1:bin	103
PID 224 wrote to memory of 3512	224	63SRPB~1:bin	103
PID 224 wrote to memory of 928	224	63SRPB~1:bin	106
PID 224 wrote to memory of 928	224	63SRPB~1:bin	106
PID 224 wrote to memory of 3256	224	63SRPB~1:bin	108
PID 224 wrote to memory of 3256	224	63SRPB~1:bin	108
PID 224 wrote to memory of 4272	224	63SRPB~1:bin	110
PID 224 wrote to memory of 4272	224	63SRPB~1:bin	110
PID 224 wrote to memory of 2204	224	63SRPB~1:bin	112
PID 224 wrote to memory of 2204	224	63SRPB~1:bin	112
PID 224 wrote to memory of 1236	224	63SRPB~1:bin	114
PID 224 wrote to memory of 1236	224	63SRPB~1:bin	114
PID 224 wrote to memory of 1768	224	63SRPB~1:bin	116
PID 224 wrote to memory of 1768	224	63SRPB~1:bin	116
PID 224 wrote to memory of 3204	224	63SRPB~1:bin	118
PID 224 wrote to memory of 3204	224	63SRPB~1:bin	118
PID 224 wrote to memory of 3056	224	63SRPB~1:bin	127
PID 224 wrote to memory of 3056	224	63SRPB~1:bin	127
PID 224 wrote to memory of 3324	224	63SRPB~1:bin	131
PID 224 wrote to memory of 3324	224	63SRPB~1:bin	131
PID 3784 wrote to memory of 3272	3784	fxssvc.exe	137
PID 3784 wrote to memory of 3272	3784	fxssvc.exe	137
PID 3784 wrote to memory of 3272	3784	fxssvc.exe	137
PID 3272 wrote to memory of 1276	3272	WVMDNK~1:bin	138
PID 3272 wrote to memory of 1276	3272	WVMDNK~1:bin	138
PID 3272 wrote to memory of 3856	3272	WVMDNK~1:bin	140
PID 3272 wrote to memory of 3856	3272	WVMDNK~1:bin	140
PID 3272 wrote to memory of 1960	3272	WVMDNK~1:bin	142
PID 3272 wrote to memory of 1960	3272	WVMDNK~1:bin	142
PID 3272 wrote to memory of 2236	3272	WVMDNK~1:bin	145
PID 3272 wrote to memory of 2236	3272	WVMDNK~1:bin	145
PID 3272 wrote to memory of 4840	3272	WVMDNK~1:bin	325
PID 3272 wrote to memory of 4840	3272	WVMDNK~1:bin	325
PID 3272 wrote to memory of 3444	3272	WVMDNK~1:bin	211
PID 3272 wrote to memory of 3444	3272	WVMDNK~1:bin	211
PID 3272 wrote to memory of 5020	3272	WVMDNK~1:bin	213
PID 3272 wrote to memory of 5020	3272	WVMDNK~1:bin	213
PID 1932 wrote to memory of 2772	1932	elevation_service.exe	157
PID 1932 wrote to memory of 2772	1932	elevation_service.exe	157
PID 1932 wrote to memory of 2772	1932	elevation_service.exe	157
PID 3272 wrote to memory of 2600	3272	WVMDNK~1:bin	333
PID 3272 wrote to memory of 2600	3272	WVMDNK~1:bin	333
PID 2772 wrote to memory of 5076	2772	CENBJ0~1:bin	506
PID 2772 wrote to memory of 5076	2772	CENBJ0~1:bin	506
PID 2772 wrote to memory of 4172	2772	CENBJ0~1:bin	377
PID 2772 wrote to memory of 4172	2772	CENBJ0~1:bin	377

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe
"C:\Users\Admin\AppData\Local\Temp\9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0.exe"
1⤵
- Windows Defender anti-emulation file check
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Roaming\RXJIZ9~1:bin
  C:\Users\Admin\AppData\Roaming\RXJIZ9~1:bin C:\Users\Admin\AppData\Local\Temp\9217F7~1.EXE
  2⤵
  - Sets service image path in registry
  - Windows Defender anti-emulation file check
  - Deletes itself
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1604
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\fxssvc.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\fxssvc.exe /reset
    3⤵
    PID:4880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4684

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Roaming\63SRPB~1:bin
  C:\Users\Admin\AppData\Roaming\63SRPB~1:bin
  2⤵
  - Windows Defender anti-emulation file check
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3524
- - C:\Windows\system32\arp.exe
    C:\Windows\system32\\arp.exe -a
    3⤵
    - Network Service Discovery
    PID:3852
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 10.127.0.1
    3⤵
    PID:3856
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 10.127.255.255
    3⤵
    PID:3512
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 37.27.61.183
    3⤵
    PID:928
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.22
    3⤵
    PID:3256
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.251
    3⤵
    PID:4272
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 224.0.0.252
    3⤵
    PID:2204
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 239.255.255.250
    3⤵
    PID:1236
- - C:\Windows\system32\nslookup.exe
    C:\Windows\system32\\nslookup.exe 255.255.255.255
    3⤵
    PID:1768
- - C:\Windows\system32\net.exe
    C:\Windows\system32\\net.exe view static.183.61.27.37.clients.your-server.de
    3⤵
    - Discovers systems in the same network
    PID:3204
- - C:\Windows\system32\net.exe
    C:\Windows\system32\\net.exe view igmp.mcast.net
    3⤵
    - Discovers systems in the same network
    PID:3056
- - C:\Windows\system32\net.exe
    C:\Windows\system32\\net.exe view mdns.mcast.net
    3⤵
    - Discovers systems in the same network
    PID:3324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 876
  2⤵
  - Program crash
  PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1968 -ip 1968
1⤵
PID:2764

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Roaming\WVMDNK~1:bin
  C:\Users\Admin\AppData\Roaming\WVMDNK~1:bin
  2⤵
  - Sets service image path in registry
  - Windows Defender anti-emulation file check
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1276
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\vssvc.exe
    3⤵
    - Possible privilege escalation attempt
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\vssvc.exe /reset
    3⤵
    PID:1960
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\wbem\WmiApSrv.exe
    3⤵
    PID:2236
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\wbem\WmiApSrv.exe /reset
    3⤵
    PID:4840
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\vds.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\vds.exe /reset
    3⤵
    PID:5020
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\SgrmBroker.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\SgrmBroker.exe /reset
    3⤵
    PID:4980
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\SensorDataService.exe
    3⤵
    - Modifies file permissions
    PID:3244
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\SensorDataService.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:112
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\msdtc.exe
    3⤵
    PID:1156
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\msdtc.exe /reset
    3⤵
    PID:3188
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:3812
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:788
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:1960
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2672
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\SysWow64\perfhost.exe
    3⤵
    PID:3208
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\SysWow64\perfhost.exe /reset
    3⤵
    PID:8
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4484
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1644
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3304
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5104
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:2624
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    - Modifies file permissions
    PID:5052
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5076
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1660
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:8
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:404
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:1456
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2672
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:1688
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:2480
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3524
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1500
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5628
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1280
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1972
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5860
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5996
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5836
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5396
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3420
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:3804
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1468
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5496
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:5180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:3400
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:3268
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5020
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3316
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5636
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:6132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 868
  2⤵
  - Program crash
  PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Roaming\CENBJ0~1:bin
  C:\Users\Admin\AppData\Roaming\CENBJ0~1:bin
  2⤵
  - Sets service image path in registry
  - Windows Defender anti-emulation file check
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5076
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\locator.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\locator.exe /reset
    3⤵
    PID:3524
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\alg.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\alg.exe /reset
    3⤵
    PID:2020
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\TieringEngineService.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\TieringEngineService.exe /reset
    3⤵
    PID:3640
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\snmptrap.exe
    3⤵
    PID:1428
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\snmptrap.exe /reset
    3⤵
    PID:1716
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1772
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:3208
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    3⤵
    PID:3860
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe /reset
    3⤵
    PID:296
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1092
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1032
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    3⤵
    PID:4540
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe /reset
    3⤵
    PID:4216
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3900
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1220
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1592
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1616
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\AgentService.exe
    3⤵
    PID:2928
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\AgentService.exe /reset
    3⤵
    PID:3244
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3380
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1444
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:3416
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3096
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2064
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2088
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:2764
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:2028
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:2224
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:528
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:296
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3240
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2428
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1180
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:5280
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:5536
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5396
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5580
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5708
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:640
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6088
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3492
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1260
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:1980
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3316
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2592
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5600
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5952
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3472
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3620
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4244
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6084
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1148
  2⤵
  - Program crash
  PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 3784 -ip 3784
1⤵
PID:4120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:820
- C:\Users\Admin\AppData\Roaming\MPVWCO~1:bin
  C:\Users\Admin\AppData\Roaming\MPVWCO~1:bin
  2⤵
  - Executes dropped EXE
  PID:4620
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4732
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\AppVClient.exe
    3⤵
    PID:100
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\AppVClient.exe /reset
    3⤵
    PID:640
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    3⤵
    PID:4252
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe /reset
    3⤵
    PID:3392
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\SearchIndexer.exe
    3⤵
    PID:1424
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\SearchIndexer.exe /reset
    3⤵
    PID:3824
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\dllhost.exe
    3⤵
    - Possible privilege escalation attempt
    PID:3948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\dllhost.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:2928
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\OpenSSH\ssh-agent.exe
    3⤵
    PID:224
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\OpenSSH\ssh-agent.exe /reset
    3⤵
    PID:2144
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\spectrum.exe
    3⤵
    - Modifies file permissions
    PID:5060
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\spectrum.exe /reset
    3⤵
    PID:404
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2000
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4084
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3660
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1256
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4900
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1524
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1560
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2868
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4588
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3208
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4520
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5320
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:3640
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    - Modifies file permissions
    PID:5792
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5820
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5472
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4992
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5352
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5328
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5692
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:5360
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5608
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5608
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    - Modifies file permissions
    PID:2376
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:5724
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5616
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 1144
  2⤵
  - Program crash
  PID:1456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:1592
- C:\Users\Admin\AppData\Roaming\I18B2S~1:bin
  C:\Users\Admin\AppData\Roaming\I18B2S~1:bin
  2⤵
  PID:3792
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3028
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    3⤵
    PID:3444
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5020
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:2600
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    3⤵
    - Modifies file permissions
    PID:3520
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe /reset
    3⤵
    PID:4044
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\msdtc.exe
    3⤵
    PID:3208
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\msdtc.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:1420
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:2604
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1440
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\AgentService.exe
    3⤵
    PID:4540
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\AgentService.exe /reset
    3⤵
    PID:2552
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\SysWow64\perfhost.exe
    3⤵
    PID:2868
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\SysWow64\perfhost.exe /reset
    3⤵
    PID:4180
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:4948
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:1660
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1928
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3772
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:2376
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1640
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1820
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4584
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:296
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:164
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:892
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5620
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5144
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2588
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5992
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5648
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:5108
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5072
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2212
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5340
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3116
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5592
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4896
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:5488
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    - Modifies file permissions
    PID:5804
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4660
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5316
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:6012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 1136
  2⤵
  - Program crash
  PID:404

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4616
- C:\Users\Admin\AppData\Roaming\0RSKUX~1:bin
  C:\Users\Admin\AppData\Roaming\0RSKUX~1:bin
  2⤵
  PID:1728
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2912
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\wbengine.exe
    3⤵
    PID:4664
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\wbengine.exe /reset
    3⤵
    PID:3132
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    - Possible privilege escalation attempt
    PID:2732
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:2692
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\OpenSSH\ssh-agent.exe
    3⤵
    - Possible privilege escalation attempt
    PID:4000
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\OpenSSH\ssh-agent.exe /reset
    3⤵
    PID:5052
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:2416
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:2612
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\system32\spectrum.exe
    3⤵
    PID:680
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\system32\spectrum.exe /reset
    3⤵
    PID:2360
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:3420
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:2444
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3356
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:696
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2388
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:772
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:4180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:4360
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4588
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2304
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4992
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4532
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5908
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2432
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5880
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:1500
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:4976
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:292
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2444
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4864
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5620
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6052
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:1604
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:5628
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2336
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:2440
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Program Files\Windows Media Player\wmpnetwk.exe
    3⤵
    PID:300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Program Files\Windows Media Player\wmpnetwk.exe /reset
    3⤵
    PID:5624
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5164
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5964
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:6052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 944
  2⤵
  - Program crash
  PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1932 -ip 1932
1⤵
PID:1964

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Windows Defender anti-emulation file check
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:4460
- C:\Users\Admin\AppData\Roaming\4J4VrWoZ:bin
  C:\Users\Admin\AppData\Roaming\4J4VrWoZ:bin
  2⤵
  PID:3108
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3064
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1968
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3916
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4612
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:2244
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\spoolsv.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5040
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\spoolsv.exe /reset
    3⤵
    - Modifies file permissions
    PID:4980
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3468
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4864
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1560
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5020
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:4748
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3868
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2236
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1468
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2568
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4144
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5916
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4908
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5288
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6044
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5668
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1300
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5836
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5396
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5688
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5384
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6052
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6000
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5564
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5752
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5936
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 956
  2⤵
  - Program crash
  PID:4392

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:336
- C:\Users\Admin\AppData\Roaming\E7JGnvS:bin
  C:\Users\Admin\AppData\Roaming\E7JGnvS:bin
  2⤵
  PID:2600
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:304
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4692
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4364
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:1868
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1932
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2416
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2936
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2224
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:964
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:4888
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2212
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2868
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3788
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4632
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:164
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5636
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5648
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4896
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3244
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5876
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5764
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6044
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5276
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5736
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3268
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2940
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:1976
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3972
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:6012
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4672
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:772
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6140
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 1232
  2⤵
  - Program crash
  PID:3680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2576

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3604
- C:\Users\Admin\AppData\Roaming\MVA6KH~1:bin
  C:\Users\Admin\AppData\Roaming\MVA6KH~1:bin
  2⤵
  PID:3624
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4172
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\System32\spoolsv.exe
    3⤵
    PID:2764
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\System32\spoolsv.exe /reset
    3⤵
    PID:3944
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:4356
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3680
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3248
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2544
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1220
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1456
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2004
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5472
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5240
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5400
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5896
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5180
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4652
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1512
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:892
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4192
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:848
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2336
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5724
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5620
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1152
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5184
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3464
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5344
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5280
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 1000
  2⤵
  - Program crash
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 820 -ip 820
1⤵
PID:4600

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2428

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
PID:1308
- C:\Users\Admin\AppData\Roaming\CMBB5O~1:bin
  C:\Users\Admin\AppData\Roaming\CMBB5O~1:bin
  2⤵
  PID:5024
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5056
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4496
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:3828
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4612
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2672
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2928
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4864
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:4356
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4360
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1592
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:876
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:756
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2296
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3472
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5716
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5552
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5392
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:8
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3200
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2244
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:408
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5808
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3472
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1976
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2100
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4180
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5640
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1000
  2⤵
  - Program crash
  PID:4668

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
1⤵
PID:5000
- C:\Users\Admin\AppData\Roaming\3FAXNS~1:bin
  C:\Users\Admin\AppData\Roaming\3FAXNS~1:bin
  2⤵
  PID:3416
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3412
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1032
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3856
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3680
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2596
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2884
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1276
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3856
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:3432
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5184
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5812
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5920
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5256
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5800
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4632
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4588
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5868
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5752
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3252
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3556
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5948
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5348
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5924
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5752
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5584
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1260
  2⤵
  - Program crash
  PID:3780

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3580

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
PID:3080
- C:\Users\Admin\AppData\Roaming\VIGROZ~1:bin
  C:\Users\Admin\AppData\Roaming\VIGROZ~1:bin
  2⤵
  PID:3280
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2624
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1512
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2568
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1300
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:3384
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1604
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:8
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5516
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6136
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5972
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5264
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1512
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5508
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5928
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5764
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5824
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5500
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5164
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6108
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5168
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5860
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5452
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5804
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 1056
  2⤵
  - Program crash
  PID:3604

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3524
- C:\Users\Admin\AppData\Roaming\YP1EWO~1:bin
  C:\Users\Admin\AppData\Roaming\YP1EWO~1:bin
  2⤵
  PID:5076
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:3256
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4552
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2444
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3080
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5396
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5972
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5260
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5596
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4312
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:6004
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4380
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5848
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5532
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5264
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5928
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5332
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5668
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5832
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5108
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5340
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4312
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:4956
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:456
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 1324
  2⤵
  - Program crash
  PID:2360

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:1232
- C:\Users\Admin\AppData\Roaming\G3V5D0~1:bin
  C:\Users\Admin\AppData\Roaming\G3V5D0~1:bin
  2⤵
  PID:3448
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4012
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:4000
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2296
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4588
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:3860
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5248
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5864
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4360
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:2228
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5008
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5856
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4552
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5536
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3268
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5556
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5212
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5952
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3296
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5204
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5696
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1972
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1280
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3680
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1312
  2⤵
  - Program crash
  PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1592 -ip 1592
1⤵
PID:1680

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:3472
- C:\Users\Admin\AppData\Roaming\6V4OKV~1:bin
  C:\Users\Admin\AppData\Roaming\6V4OKV~1:bin
  2⤵
  PID:1384
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4584
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3296
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1972
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6040
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:404
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5212
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5700
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4492
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5752
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3176
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5856
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3948
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5992
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1176
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:3176
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5240
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3788
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4552
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5600
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 1352
  2⤵
  - Program crash
  PID:4852

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe
1⤵
PID:4660
- C:\Users\Admin\AppData\Roaming\AZPVP6~1:bin
  C:\Users\Admin\AppData\Roaming\AZPVP6~1:bin
  2⤵
  PID:2304
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5156
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5612
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4920
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5532
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2440
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3788
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5640
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5724
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:5752
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5784
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5384
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:1260
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5936
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1272
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5616
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5280
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5760
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5880
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1972
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 1104
  2⤵
  - Program crash
  PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:3400
- C:\Users\Admin\AppData\Roaming\ZHSynP4:bin
  C:\Users\Admin\AppData\Roaming\ZHSynP4:bin
  2⤵
  PID:4692
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5268
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5848
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:2024
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6072
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5276
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:5908
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5976
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3788
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:2588
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1748
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5668
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:1172
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5488
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3804
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4852
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:2936
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1364
  2⤵
  - Program crash
  PID:2568

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
1⤵
PID:1748
- C:\Users\Admin\AppData\Roaming\2Net2O:bin
  C:\Users\Admin\AppData\Roaming\2Net2O:bin
  2⤵
  PID:6136
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5188
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5832
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3268
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:6140
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5792
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5324
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:300
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5888
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5316
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5792
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4192
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4604
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5992
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3860
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:5340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 1380
  2⤵
  - Program crash
  PID:3252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:316
- C:\Users\Admin\AppData\Roaming\LRHBEzqI:bin
  C:\Users\Admin\AppData\Roaming\LRHBEzqI:bin
  2⤵
  PID:716
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5260
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Possible privilege escalation attempt
    PID:5628
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:3472
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5128
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5708
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4232
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5500
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:116
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:6140
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5648
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4356
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    - Modifies file permissions
    PID:3708
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 1384
  2⤵
  - Program crash
  PID:300

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2212

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:1152
- C:\Users\Admin\AppData\Roaming\8VnwzCUA:bin
  C:\Users\Admin\AppData\Roaming\8VnwzCUA:bin
  2⤵
  PID:4360
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5544
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5980
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    PID:6036
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4852
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5628
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5208
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:1980
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3316
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5572
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5204
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2700
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 1420
  2⤵
  - Program crash
  PID:5228

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4716
- C:\Users\Admin\AppData\Roaming\ODVZDO~1:bin
  C:\Users\Admin\AppData\Roaming\ODVZDO~1:bin
  2⤵
  PID:5776
- - C:\Windows\system32\vssadmin.exe
    C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:5828
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5820
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5240
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:4984
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:4244
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5460
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5876
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:3472
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    PID:5208
- - C:\Windows\system32\takeown.exe
    C:\Windows\system32\takeown.exe /F C:\Windows\servicing\TrustedInstaller.exe
    3⤵
    PID:5684
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\Windows\servicing\TrustedInstaller.exe /reset
    3⤵
    - Modifies file permissions
    PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 1416
  2⤵
  - Program crash
  PID:4920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
PID:3540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:2648

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4616 -ip 4616
1⤵
PID:3264

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:4952

C:\Windows\system32\wbengine.exe
C:\Windows\system32\wbengine.exe
1⤵
PID:4932

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3704

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4460 -ip 4460
1⤵
PID:1524

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5056

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2808

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4840

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:288

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3352

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3408

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
PID:3560

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4748

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:848

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 336 -ip 336
1⤵
PID:4584

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3008

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4476

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:1156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3660

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4360

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3604 -ip 3604
1⤵
PID:1032

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:772

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4180

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:3264

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1308 -ip 1308
1⤵
PID:224

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:716

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
PID:2692

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3448

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4584

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5000 -ip 5000
1⤵
PID:2328

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3508

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:772

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1092

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"
1⤵
PID:4668

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1384

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3080 -ip 3080
1⤵
PID:2628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2936

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1592

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3876

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2936

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2164

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
PID:4248

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1232 -ip 1232
1⤵
PID:1308

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2696

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4584

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1480

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:4796

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3756

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3524 -ip 3524
1⤵
PID:876

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1972

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2332

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2460

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3640

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:716

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:224

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3472 -ip 3472
1⤵
PID:1232

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2612

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1512

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4360

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3804

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:5216

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5268

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5548

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4660 -ip 4660
1⤵
PID:5792

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5900

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6100

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2568

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:300

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5508

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe
1⤵
PID:5644

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5700

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3400 -ip 3400
1⤵
PID:5988

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6028

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6032

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
PID:3640

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3240

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4000

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1748 -ip 1748
1⤵
PID:5568

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3180

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2416

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:852

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1092

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4192

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"
1⤵
PID:5112

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5696

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 316 -ip 316
1⤵
PID:3464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1260

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5692

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5860

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2164

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:5940

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5404

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1152 -ip 1152
1⤵
PID:5452

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5876

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1064

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6140

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
PID:2612

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2236

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6088

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4716 -ip 4716
1⤵
PID:5280

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4244

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5800

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5128

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5392

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3268

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4588

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2336

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:4976

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2020

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5180

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5488

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5352

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2920

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5860

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:116

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5696

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3968

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:528

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5404

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:852

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1152

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2940

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:6132

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:1748

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5384

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:2376

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5684

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:3532

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
1⤵
PID:5288

C:\Windows\system32\vssadmin.exe
C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
1⤵
- Interacts with shadow copies
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

RXJIZ9~1:bin

Path C:\Users\Admin\AppData\Roaming\RXJIZ9~1:bin
Size 296KB
SHA256 9217f79feca332aeeadabed6b7b0c10bb0cdf9b1d1db5aa83a4e8ac704bf80c0
MD5 2d96e4c716eb0cf915026ed8a7d01af0
SHA1 8d793f2ec2b319b9ab4d7d6f12275d15c4c73f88
SHA512 560a5dd1621a1be6ed93203378d5170831364d551c13a7288d558832c65e74b13c6372205d8cb32d1256a5fbe5202c43e2d18416c63a2fdd62a12021b8eb2e18
SSDEEP 3072:ejF3EAH9Z1IibJjCuS+Cu8au2cippFwPLjm2E3DkV+TJUDmKtfF7G+mbuAspFNmw:chH9Z1Ii5Cu025uL62EIEVCthblJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

245E9.tmp

Path C:\Windows\Temp\245E9.tmp
Size 26B
SHA256 ad1745fb0662b3217f3d8e591fc3476278766709a185b43bdea26c966071a6c3
MD5 e028c8417dd1f4a1bbebe990687f60be
SHA1 735a00747091318bb37e2a99495d7d2d329eeddc
SHA512 a2a1c67f7b9418cd5d2da78bf908fa8286dc4e55926107636e542fff2b8da75cc1e2b934ee77e148ed082df9b090b590d19f18a428f6e656824fdea202c8200c
MD5 SHA1 SHA512

Submit Download

mDA55D.tmp

Path C:\Windows\Temp\mDA55D.tmp
Size 42B
SHA256 cf664db1f0277133d904fa8f7c8f1cc17122d0687bfbd9a30db4f79535385fb5
MD5 9686e36f7086f18dc866351b5f1dcd92
SHA1 7fbf5558d7509468fc974e92f6464ccddb0bd894
SHA512 7482eda4a3ef290125db3cc96541421f96acc1f450e991a939e445ce93a36ae1103e161218c75099558e4e2fed90124d78fce6b27994d00a8f386386f1f2a4d6
MD5 SHA1 SHA512

Submit Download

ox2D6C.tmp

Path C:\Windows\Temp\ox2D6C.tmp
Size 68B
SHA256 a13792cde232bebbc4f38a63a057bad7a2674e8c97415fd6646be416e112d1f2
MD5 5bef1c13e1c53aad094bb94086afb7e7
SHA1 9caca218662cc7eab126bc085b1d8ac9e359913f
SHA512 e1196949a266e5d0fc3e27a571a9e92ec1acf9db40ca59013cc1f8b746fa6242372301ac02158e04599fcaedc9e4d4e39777685df2dc9c8af4dafab89a8ef29a
MD5 SHA1 SHA512

Submit Download

memory/224-2940-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/288-32107-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/336-32151-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/716-32263-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/772-32191-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/772-32307-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/820-31976-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/848-32127-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/892-32213-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1092-32314-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1308-32260-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1384-32334-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1444-32325-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1592-32357-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1592-32016-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1932-31940-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1968-2939-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1968-31907-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1968-28027-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1968-17486-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1968-10441-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/1972-32180-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2184-32279-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2212-32042-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2304-32219-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2428-31963-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2484-15-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2484-9-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2484-8-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2772-32282-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2936-32354-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/2936-32378-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3008-32141-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3080-32364-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3180-32343-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3272-32244-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3356-32233-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3408-32115-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3448-32271-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3508-32300-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3580-31987-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3604-32199-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3660-32162-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3704-32064-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3784-31927-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3784-32152-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3792-32358-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3860-32134-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3868-0-0x0000000000610000-0x0000000000615000-memory.dmp

Download

memory/3868-1-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3868-6-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3876-32368-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/3948-32293-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4180-32198-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4276-32226-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4360-32169-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4460-32099-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4584-32274-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4616-32072-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4620-32330-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4748-32124-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/4840-32096-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5000-32323-0x0000000000400000-0x000000000044D000-memory.dmp

Download

memory/5056-32092-0x0000000000400000-0x000000000044D000-memory.dmp

Download