privateloader | 1f23c8f3a32d58689391b37c0ea1dd12ec73c65f2f5b09390ec7f62daeb25db2

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

setup.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5476-437-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ RHdyedZdEglwILJnVm4Uv5lc.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exe

pid process

2832 powershell.exe
7460 powershell.EXE
7448 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RHdyedZdEglwILJnVm4Uv5lc.exe

pid	process
2832	powershell.exe
7460	powershell.EXE
7448	powershell.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RHdyedZdEglwILJnVm4Uv5lc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RHdyedZdEglwILJnVm4Uv5lc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

Install.exesetup.exeFsbJKh8aonw5sQtLcXpEFxgS.exeexplorti.exego.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	FsbJKh8aonw5sQtLcXpEFxgS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	explorti.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	go.exe

Drops startup file 1 IoCs

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNT.lnk	RHdyedZdEglwILJnVm4Uv5lc.exe

Executes dropped EXE 18 IoCs

Processes:

setup.exeXtExdTwRk85Ef9lyLZjCawq3.exerqZyiYpynkyFOoFpWL8VIS3R.exeaX_gnwqf8iK9BXkE4g5kS6KK.exeFsbJKh8aonw5sQtLcXpEFxgS.exeRHdyedZdEglwILJnVm4Uv5lc.exeKs8jmRuej1Qp4HT4H48oNVZ6.exe1mwC9JJ9PRw2t4X5BfhO3TV5.exe60fXr1fpIbRtEKeXBaxr893u.exe5pYhbSUnUcsBRD4HUfjlVvqx.exeXtExdTwRk85Ef9lyLZjCawq3.tmpsoundchangerbeta32_64.exeInstall.exesoundchangerbeta32_64.exeexplorti.exeInstall.exego.exeexplorti.exe

pid	process
5000	setup.exe
2132	XtExdTwRk85Ef9lyLZjCawq3.exe
872	rqZyiYpynkyFOoFpWL8VIS3R.exe
2476	aX_gnwqf8iK9BXkE4g5kS6KK.exe
2448	FsbJKh8aonw5sQtLcXpEFxgS.exe
1016	RHdyedZdEglwILJnVm4Uv5lc.exe
4812	Ks8jmRuej1Qp4HT4H48oNVZ6.exe
1368	1mwC9JJ9PRw2t4X5BfhO3TV5.exe
2156	60fXr1fpIbRtEKeXBaxr893u.exe
5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
884	XtExdTwRk85Ef9lyLZjCawq3.tmp
1984	soundchangerbeta32_64.exe
5260	Install.exe
5388	soundchangerbeta32_64.exe
5588	explorti.exe
5636	Install.exe
2016	go.exe
1480	explorti.exe

Loads dropped DLL 1 IoCs

Processes:

XtExdTwRk85Ef9lyLZjCawq3.tmp

pid process

884 XtExdTwRk85Ef9lyLZjCawq3.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
884	XtExdTwRk85Ef9lyLZjCawq3.tmp

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\SimpleAdobe\RHdyedZdEglwILJnVm4Uv5lc.exe	themida
behavioral1/memory/1016-202-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-221-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-220-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-231-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-230-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-223-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-222-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida
behavioral1/memory/1016-917-0x0000000000A20000-0x00000000013AF000-memory.dmp	themida

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc
Destination IP	141.98.234.31

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exeexplorti.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExtreamFanV5 = "C:\\Users\\Admin\\AppData\\Local\\ExtreamFanV5\\ExtreamFanV5.exe"	RHdyedZdEglwILJnVm4Uv5lc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000017001\\go.exe"	explorti.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RHdyedZdEglwILJnVm4Uv5lc.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

133 iplogger.org
134 iplogger.org
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

56 ipinfo.io
51 api.myip.com
52 api.myip.com
54 ipinfo.io

flow	ioc
133	iplogger.org
134	iplogger.org

flow	ioc
56	ipinfo.io
51	api.myip.com
52	api.myip.com
54	ipinfo.io

Power Settings 1 TTPs 40 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	process
6972	powercfg.exe
7180	powercfg.exe
5712	powercfg.exe
7048	powercfg.exe
7536	powercfg.exe
6912	powercfg.exe
6232	powercfg.exe
316	powercfg.exe
7232	powercfg.exe
2332	powercfg.exe
6168	powercfg.exe
2812	powercfg.exe
2348	powercfg.exe
3804	powercfg.exe
6704	powercfg.exe
444	powercfg.exe
1740	powercfg.exe
1556	powercfg.exe
7496	powercfg.exe
6916	powercfg.exe
6216	powercfg.exe
7288	powercfg.exe
7492	powercfg.exe
7120	powercfg.exe
7316	powercfg.exe
5784	powercfg.exe
6776	powercfg.exe
7488	powercfg.exe
1676	powercfg.exe
6868	powercfg.exe
6204	powercfg.exe
6896	powercfg.exe
7064	powercfg.exe
7096	powercfg.exe
4508	powercfg.exe
1344	powercfg.exe
6768	powercfg.exe
7528	powercfg.exe
3628	powercfg.exe
4740	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

setup.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

RHdyedZdEglwILJnVm4Uv5lc.exe

pid process

1016 RHdyedZdEglwILJnVm4Uv5lc.exe

pid	process
1016	RHdyedZdEglwILJnVm4Uv5lc.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

1mwC9JJ9PRw2t4X5BfhO3TV5.exe5pYhbSUnUcsBRD4HUfjlVvqx.exeaX_gnwqf8iK9BXkE4g5kS6KK.exe60fXr1fpIbRtEKeXBaxr893u.exeexplorti.exe

description	pid	process	target process
PID 1368 set thread context of 5176	1368	1mwC9JJ9PRw2t4X5BfhO3TV5.exe	MSBuild.exe
PID 5108 set thread context of 5240	5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe	MSBuild.exe
PID 2476 set thread context of 5468	2476	aX_gnwqf8iK9BXkE4g5kS6KK.exe	RegAsm.exe
PID 2156 set thread context of 5476	2156	60fXr1fpIbRtEKeXBaxr893u.exe	RegAsm.exe
PID 5588 set thread context of 1480	5588	explorti.exe	explorti.exe

Drops file in Windows directory 1 IoCs

Processes:

FsbJKh8aonw5sQtLcXpEFxgS.exe

description ioc process

File created C:\Windows\Tasks\explorti.job FsbJKh8aonw5sQtLcXpEFxgS.exe
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

6436 sc.exe
7240 sc.exe
7332 sc.exe
752 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explorti.job	FsbJKh8aonw5sQtLcXpEFxgS.exe

pid	process
6436	sc.exe
7240	sc.exe
7332	sc.exe
752	sc.exe

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
7808	7500	WerFault.exe	MSBuild.exe
6488	7500	WerFault.exe	MSBuild.exe
4880	6044	WerFault.exe	Install.exe
5320	5636	WerFault.exe	Install.exe
2812	7312	WerFault.exe	eeZKFKo.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MSBuild.exeAcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

3680 timeout.exe
5616 timeout.exe

pid	process
3680	timeout.exe
5616	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
7228	schtasks.exe
6620	schtasks.exe
2900	schtasks.exe
6944	schtasks.exe
6284	schtasks.exe
2308	schtasks.exe
7948	schtasks.exe
4856	schtasks.exe
8064	schtasks.exe
6744	schtasks.exe
764	schtasks.exe
5732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

setup.exetaskmgr.exeRHdyedZdEglwILJnVm4Uv5lc.exe5pYhbSUnUcsBRD4HUfjlVvqx.exeMSBuild.exe

pid	process
5000	setup.exe
5000	setup.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
1016	RHdyedZdEglwILJnVm4Uv5lc.exe
1016	RHdyedZdEglwILJnVm4Uv5lc.exe
2748	taskmgr.exe
2748	taskmgr.exe
5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
5176	MSBuild.exe
5176	MSBuild.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

4712 OpenWith.exe
732 7zFM.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

7zFM.exetaskmgr.exe1mwC9JJ9PRw2t4X5BfhO3TV5.exe5pYhbSUnUcsBRD4HUfjlVvqx.exeRegAsm.exeRegAsm.exepowershell.exe

description	pid	process
Token: SeRestorePrivilege	732	7zFM.exe
Token: 35	732	7zFM.exe
Token: SeSecurityPrivilege	732	7zFM.exe
Token: SeDebugPrivilege	2748	taskmgr.exe
Token: SeSystemProfilePrivilege	2748	taskmgr.exe
Token: SeCreateGlobalPrivilege	2748	taskmgr.exe
Token: SeDebugPrivilege	1368	1mwC9JJ9PRw2t4X5BfhO3TV5.exe
Token: SeDebugPrivilege	5108	5pYhbSUnUcsBRD4HUfjlVvqx.exe
Token: SeDebugPrivilege	5468	RegAsm.exe
Token: SeBackupPrivilege	5468	RegAsm.exe
Token: SeSecurityPrivilege	5468	RegAsm.exe
Token: SeSecurityPrivilege	5468	RegAsm.exe
Token: SeSecurityPrivilege	5468	RegAsm.exe
Token: SeSecurityPrivilege	5468	RegAsm.exe
Token: SeDebugPrivilege	5476	RegAsm.exe
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exetaskmgr.exe

pid	process
732	7zFM.exe
732	7zFM.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe
2748	taskmgr.exe

Suspicious use of SetWindowsHookEx 45 IoCs

Processes:

OpenWith.exeAcroRd32.exesetup.exeXtExdTwRk85Ef9lyLZjCawq3.exerqZyiYpynkyFOoFpWL8VIS3R.exeRHdyedZdEglwILJnVm4Uv5lc.exeFsbJKh8aonw5sQtLcXpEFxgS.exeXtExdTwRk85Ef9lyLZjCawq3.tmpaX_gnwqf8iK9BXkE4g5kS6KK.exe60fXr1fpIbRtEKeXBaxr893u.exesoundchangerbeta32_64.exeMSBuild.exeMSBuild.exeInstall.exesoundchangerbeta32_64.exeRegAsm.exeexplorti.exeRegAsm.exeInstall.exego.exe

pid	process
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
3424	AcroRd32.exe
3424	AcroRd32.exe
3424	AcroRd32.exe
3424	AcroRd32.exe
5000	setup.exe
2132	XtExdTwRk85Ef9lyLZjCawq3.exe
872	rqZyiYpynkyFOoFpWL8VIS3R.exe
1016	RHdyedZdEglwILJnVm4Uv5lc.exe
2448	FsbJKh8aonw5sQtLcXpEFxgS.exe
884	XtExdTwRk85Ef9lyLZjCawq3.tmp
2476	aX_gnwqf8iK9BXkE4g5kS6KK.exe
2156	60fXr1fpIbRtEKeXBaxr893u.exe
1984	soundchangerbeta32_64.exe
5176	MSBuild.exe
5240	MSBuild.exe
5260	Install.exe
5388	soundchangerbeta32_64.exe
5476	RegAsm.exe
5588	explorti.exe
5468	RegAsm.exe
5636	Install.exe
2016	go.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4712 wrote to memory of 3424	4712	OpenWith.exe	AcroRd32.exe
PID 4712 wrote to memory of 3424	4712	OpenWith.exe	AcroRd32.exe
PID 4712 wrote to memory of 3424	4712	OpenWith.exe	AcroRd32.exe
PID 3424 wrote to memory of 3288	3424	AcroRd32.exe	RdrCEF.exe
PID 3424 wrote to memory of 3288	3424	AcroRd32.exe	RdrCEF.exe
PID 3424 wrote to memory of 3288	3424	AcroRd32.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 1912	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe
PID 3288 wrote to memory of 4464	3288	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\archive.rar
1⤵
- Modifies registry class
PID:3028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\archive.rar"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CB6FBDD95B3A2A8E025D39A3F9C91740 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CB6FBDD95B3A2A8E025D39A3F9C91740 --renderer-client-id=2 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1912

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2B78C6691A6726BE8A159A47946EA95B --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:4464

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E155ED5B97B6D207C2794991B5D48F3E --mojo-platform-channel-handle=2264 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:4012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AE355220187362BC4122C5FACC97CBF --mojo-platform-channel-handle=1992 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2924

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E5BAEA6763F42D380B3CDAB2404DD69 --mojo-platform-channel-handle=2024 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2740

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:732

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Users\Admin\Documents\SimpleAdobe\XtExdTwRk85Ef9lyLZjCawq3.exe
C:\Users\Admin\Documents\SimpleAdobe\XtExdTwRk85Ef9lyLZjCawq3.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2132

C:\Users\Admin\AppData\Local\Temp\is-2MV61.tmp\XtExdTwRk85Ef9lyLZjCawq3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-2MV61.tmp\XtExdTwRk85Ef9lyLZjCawq3.tmp" /SL5="$901E0,4806151,54272,C:\Users\Admin\Documents\SimpleAdobe\XtExdTwRk85Ef9lyLZjCawq3.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:884

C:\Users\Admin\AppData\Local\Sound Changer Beta\soundchangerbeta32_64.exe
"C:\Users\Admin\AppData\Local\Sound Changer Beta\soundchangerbeta32_64.exe" -i
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Users\Admin\AppData\Local\Sound Changer Beta\soundchangerbeta32_64.exe
"C:\Users\Admin\AppData\Local\Sound Changer Beta\soundchangerbeta32_64.exe" -s
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Users\Admin\Documents\SimpleAdobe\Ks8jmRuej1Qp4HT4H48oNVZ6.exe
C:\Users\Admin\Documents\SimpleAdobe\Ks8jmRuej1Qp4HT4H48oNVZ6.exe
2⤵
- Executes dropped EXE
PID:4812

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Power Settings
PID:6768

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Power Settings
PID:6776

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Power Settings
PID:7048

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Power Settings
PID:7232

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "CIFUBVHI"
3⤵
- Launches sc.exe
PID:7240

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
3⤵
- Launches sc.exe
PID:7332

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:6436

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "CIFUBVHI"
3⤵
- Launches sc.exe
PID:752

C:\Users\Admin\Documents\SimpleAdobe\rqZyiYpynkyFOoFpWL8VIS3R.exe
C:\Users\Admin\Documents\SimpleAdobe\rqZyiYpynkyFOoFpWL8VIS3R.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:872

C:\Users\Admin\AppData\Local\Temp\7zS7F48.tmp\Install.exe
.\Install.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5260

C:\Users\Admin\AppData\Local\Temp\7zS8CA6.tmp\Install.exe
.\Install.exe /WdKhwdidG "385132" /S
4⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5636

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
5⤵
PID:2496

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
PID:224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
8⤵
PID:5488

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bIIyZWzHnmHiZsesSy" /SC once /ST 22:13:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS8CA6.tmp\Install.exe\" Nz /gpdidL 385132 /S" /V1 /F
5⤵
- Scheduled Task/Job: Scheduled Task
PID:6284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 1140
5⤵
- Program crash
PID:5320

C:\Users\Admin\Documents\SimpleAdobe\RHdyedZdEglwILJnVm4Uv5lc.exe
C:\Users\Admin\Documents\SimpleAdobe\RHdyedZdEglwILJnVm4Uv5lc.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1016

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST
3⤵
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST
3⤵
- Scheduled Task/Job: Scheduled Task
PID:5732

C:\Users\Admin\Documents\SimpleAdobe\aX_gnwqf8iK9BXkE4g5kS6KK.exe
C:\Users\Admin\Documents\SimpleAdobe\aX_gnwqf8iK9BXkE4g5kS6KK.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5468

C:\Users\Admin\Documents\SimpleAdobe\FsbJKh8aonw5sQtLcXpEFxgS.exe
C:\Users\Admin\Documents\SimpleAdobe\FsbJKh8aonw5sQtLcXpEFxgS.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:5588

C:\Users\Admin\AppData\Local\Temp\1000017001\go.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\go.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B24F.tmp\B250.tmp\B251.bat C:\Users\Admin\AppData\Local\Temp\1000017001\go.exe"
5⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
6⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffaa0a3ab58,0x7ffaa0a3ab68,0x7ffaa0a3ab78
7⤵
PID:5340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:2
7⤵
PID:3360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:8
7⤵
PID:5152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2008 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:8
7⤵
PID:5512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3116 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:1
7⤵
PID:4044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:1
7⤵
PID:1060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4044 --field-trial-handle=2412,i,331190154629732667,9354605065011798376,131072 /prefetch:1
7⤵
PID:7136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
6⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffa9f9d46f8,0x7ffa9f9d4708,0x7ffa9f9d4718
7⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
7⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
7⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
7⤵
PID:6164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
7⤵
PID:6320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
7⤵
PID:6384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7113396949860208705,8731049698339891128,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
7⤵
PID:4656

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
6⤵
PID:5208

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
7⤵
PID:3304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.0.46596513\1042497105" -parentBuildID 20230214051806 -prefsHandle 1632 -prefMapHandle 1676 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0795cac3-af11-45fb-972e-3178ccc90e48} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 1868 1f0fff0d758 gpu
8⤵
PID:5712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.1.1436908097\1760350087" -parentBuildID 20230214051806 -prefsHandle 2476 -prefMapHandle 2472 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cda5308-c7e9-48e3-945d-3428a56be944} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 2496 1f084b8f458 socket
8⤵
PID:5072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.2.1028217505\1475732146" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2940 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 928 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae4ea527-15b5-4cf1-ad2b-b10d3d7740ce} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 876 1f086d23358 tab
8⤵
PID:1384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.3.17466487\1182604668" -childID 2 -isForBrowser -prefsHandle 3628 -prefMapHandle 3624 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 928 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38fd490f-a216-4636-a9ba-499b4ee19119} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 3636 1f08915af58 tab
8⤵
PID:6564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.4.1544314452\2111182746" -childID 3 -isForBrowser -prefsHandle 5272 -prefMapHandle 5268 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 928 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7147787c-700d-4d45-bfc7-b1f9058b9cd3} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 5188 1f08b363158 tab
8⤵
PID:7352

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.5.175528244\1041578542" -childID 4 -isForBrowser -prefsHandle 5388 -prefMapHandle 5384 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 928 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {454bd5e7-cadc-4b1d-baf8-3ebdba890a7b} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 5432 1f08b362b58 tab
8⤵
PID:7360

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3304.6.1929070194\201118717" -childID 5 -isForBrowser -prefsHandle 5680 -prefMapHandle 5676 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 928 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {96c3eb34-4897-46d5-bfb2-140d6c62fe71} 3304 "\\.\pipe\gecko-crash-server-pipe.3304" 5692 1f08a945158 tab
8⤵
PID:7372

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
"C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
4⤵
- Executes dropped EXE
PID:1480

C:\Users\Admin\AppData\Local\Temp\1000021001\e933fe72f9.exe
"C:\Users\Admin\AppData\Local\Temp\1000021001\e933fe72f9.exe"
4⤵
PID:5028

C:\Users\Admin\Documents\SimpleAdobe\1mwC9JJ9PRw2t4X5BfhO3TV5.exe
C:\Users\Admin\Documents\SimpleAdobe\1mwC9JJ9PRw2t4X5BfhO3TV5.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FHJDBKJKFIEC" & exit
4⤵
PID:8016

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:3680

C:\Users\Admin\Documents\SimpleAdobe\60fXr1fpIbRtEKeXBaxr893u.exe
C:\Users\Admin\Documents\SimpleAdobe\60fXr1fpIbRtEKeXBaxr893u.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5476

C:\Users\Admin\Documents\SimpleAdobe\5pYhbSUnUcsBRD4HUfjlVvqx.exe
C:\Users\Admin\Documents\SimpleAdobe\5pYhbSUnUcsBRD4HUfjlVvqx.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:2152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:5196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:5240

C:\ProgramData\GCBGCAFIIE.exe
"C:\ProgramData\GCBGCAFIIE.exe"
4⤵
PID:812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:7500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 500
6⤵
- Program crash
PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 500
6⤵
- Program crash
PID:6488

C:\ProgramData\FCBAECGIEB.exe
"C:\ProgramData\FCBAECGIEB.exe"
4⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
5⤵
PID:7496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FBKJKEHIJECG" & exit
4⤵
PID:5828

C:\Windows\SysWOW64\timeout.exe
timeout /t 10
5⤵
- Delays execution with timeout.exe
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1796

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2748

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:6420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6872

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
PID:6984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6312

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
PID:7416

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:7496

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:7488

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:7528

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:7536

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:7544

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:5668

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:6912

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:1676

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:2348

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:3628

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:4572

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:1912

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:6916

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:2332

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:6168

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:3804

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:4488

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:6744

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:6204

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:6216

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:6232

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:6972

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:6948

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:6904

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:6896

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:6704

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:2812

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:4740

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:1020

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:6788

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:7096

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:7180

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:6868

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:7288

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:7160

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:7056

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:7316

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:7120

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:4508

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:7492

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:3348

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:8000

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:444

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:1344

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:1740

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:316

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:5792

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
"C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe"
3⤵
PID:6420

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
4⤵
- Power Settings
PID:1556

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
4⤵
- Power Settings
PID:7064

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
4⤵
- Power Settings
PID:5712

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
4⤵
- Power Settings
PID:5784

C:\Windows\system32\svchost.exe
svchost.exe
4⤵
PID:4800

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7500 -ip 7500
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 7500 -ip 7500
1⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\7zS8CA6.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS8CA6.tmp\Install.exe Nz /gpdidL 385132 /S
1⤵
PID:6044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
PID:6212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
PID:6416

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:3804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:6324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:6408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:6268

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:3776

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:4488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:6508

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:6784

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:7012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:7212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:1212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:7016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:7204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:6860

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:6236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:7044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:6204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:7220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:5500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:7152

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:7116

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:2832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:6844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:1664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:6712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AqhCymdmIBUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AqhCymdmIBUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QubjZgZsgVxU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QubjZgZsgVxU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XhLCDmquyDmYC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XhLCDmquyDmYC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tSRsKJOgU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tSRsKJOgU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mjUPcNFqgWzmMMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\mjUPcNFqgWzmMMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gGlzHXLNukBnGkUk\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\gGlzHXLNukBnGkUk\" /t REG_DWORD /d 0 /reg:64;"
2⤵
PID:1564

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:6196

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:6900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AqhCymdmIBUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:6896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QubjZgZsgVxU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5096

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QubjZgZsgVxU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XhLCDmquyDmYC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XhLCDmquyDmYC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4348

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tSRsKJOgU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tSRsKJOgU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:6528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mjUPcNFqgWzmMMVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:3440

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\mjUPcNFqgWzmMMVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:6444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:840

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5128

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb /t REG_DWORD /d 0 /reg:32
3⤵
PID:6332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\PKLMGLEKhliiDLHGb /t REG_DWORD /d 0 /reg:64
3⤵
PID:4960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gGlzHXLNukBnGkUk /t REG_DWORD /d 0 /reg:32
3⤵
PID:1164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\gGlzHXLNukBnGkUk /t REG_DWORD /d 0 /reg:64
3⤵
PID:5836

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gMSHVPQdt" /SC once /ST 12:32:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2308

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gMSHVPQdt"
2⤵
PID:6336

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gMSHVPQdt"
2⤵
PID:7096

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tYRFAYEmQKskppbAu" /SC once /ST 13:34:08 /RU "SYSTEM" /TR "\"C:\Windows\Temp\gGlzHXLNukBnGkUk\AwzEvpaQGkMxDYb\eeZKFKo.exe\" C2 /niWBdidbf 385132 /S" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:7228

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "tYRFAYEmQKskppbAu"
2⤵
PID:7240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 880
2⤵
- Program crash
PID:4880

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
PID:2948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:7460

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:7796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:7756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:7760

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5504

C:\Windows\Temp\gGlzHXLNukBnGkUk\AwzEvpaQGkMxDYb\eeZKFKo.exe
C:\Windows\Temp\gGlzHXLNukBnGkUk\AwzEvpaQGkMxDYb\eeZKFKo.exe C2 /niWBdidbf 385132 /S
1⤵
PID:7312

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bIIyZWzHnmHiZsesSy"
2⤵
PID:5800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:7672

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:4840

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:7416

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
PID:7448

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
PID:4680

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tSRsKJOgU\wAuNny.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wovFAmtOpAxrHrl" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:7948

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wovFAmtOpAxrHrl2" /F /xml "C:\Program Files (x86)\tSRsKJOgU\awTwKtb.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "wovFAmtOpAxrHrl"
2⤵
PID:7616

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "wovFAmtOpAxrHrl"
2⤵
PID:7188

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OrspJZQoDyehPl" /F /xml "C:\Program Files (x86)\QubjZgZsgVxU2\mVIhuBD.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:8064

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "AfBtKiWWYHIKP2" /F /xml "C:\ProgramData\mjUPcNFqgWzmMMVB\fIvHwRk.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:6620

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WyNLkpRDmiMxCDgFB2" /F /xml "C:\Program Files (x86)\qZsdLtoLnmdMsAbZENR\pcGMBAa.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "sTjfLxzHimdPzpCahty2" /F /xml "C:\Program Files (x86)\XhLCDmquyDmYC\AoNIRfw.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:6944

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "eXInJQFSFxFSzhMHF" /SC once /ST 03:04:18 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\gGlzHXLNukBnGkUk\jbeUrVxm\vPcAXXR.dll\",#1 /FwJdidu 385132" /V1 /F
2⤵
- Scheduled Task/Job: Scheduled Task
PID:6744

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "eXInJQFSFxFSzhMHF"
2⤵
PID:6820

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "tYRFAYEmQKskppbAu"
2⤵
PID:5352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7312 -s 2060
2⤵
- Program crash
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6044 -ip 6044
1⤵
PID:7320

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\gGlzHXLNukBnGkUk\jbeUrVxm\vPcAXXR.dll",#1 /FwJdidu 385132
1⤵
PID:6204

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\gGlzHXLNukBnGkUk\jbeUrVxm\vPcAXXR.dll",#1 /FwJdidu 385132
2⤵
PID:7220

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "eXInJQFSFxFSzhMHF"
3⤵
PID:5596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5636 -ip 5636
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7312 -ip 7312
1⤵
PID:6200

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
PID:6376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery