redline | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7546020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7546020.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4895983.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4895983.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4187895.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4187895.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4579680.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4579680.exe

Loads dropped DLL 33 IoCs

pid	Process
4748	setup_install.exe
4748	setup_install.exe
4748	setup_install.exe
4748	setup_install.exe
4748	setup_install.exe
4748	setup_install.exe
2904	Tue11b9d76a96506.tmp
5540	setup_2.tmp
5968	setup_2.tmp
5208	rundll32.exe
6040	Tue11e4e580f2e8141a3.exe
2552	installer.exe
2552	installer.exe
2552	installer.exe
5800	MsiExec.exe
5800	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2104	MsiExec.exe
2552	installer.exe
2104	MsiExec.exe
2104	MsiExec.exe
5124	MsiExec.exe
5124	MsiExec.exe
2104	MsiExec.exe
4056	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/files/0x000100000002b1ee-298.dat	themida
behavioral5/files/0x000100000002b1ee-312.dat	themida
behavioral5/files/0x000200000002b1e0-330.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	178360.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Sidebar\\Vudufeshalo.exe\""	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4187895.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4579680.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7546020.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4895983.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	installer.exe
File opened (read-only)	\??\U:	installer.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	installer.exe
File opened (read-only)	\??\S:	installer.exe
File opened (read-only)	\??\X:	installer.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	installer.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	installer.exe
File opened (read-only)	\??\Q:	installer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	installer.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	installer.exe
File opened (read-only)	\??\Z:	installer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	installer.exe
File opened (read-only)	\??\M:	installer.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	installer.exe
File opened (read-only)	\??\O:	installer.exe
File opened (read-only)	\??\P:	installer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	installer.exe
File opened (read-only)	\??\W:	installer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	installer.exe
File opened (read-only)	\??\H:	installer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
5556	4187895.exe
1016	4579680.exe
4944	7546020.exe
5224	4895983.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 2608	1492	Tue11e4e580f2e8141a3.exe	106
PID 1492 set thread context of 4624	1492	Tue11e4e580f2e8141a3.exe	121
PID 1492 set thread context of 5612	1492	Tue11e4e580f2e8141a3.exe	130
PID 1492 set thread context of 6052	1492	Tue11e4e580f2e8141a3.exe	143
PID 1492 set thread context of 5664	1492	Tue11e4e580f2e8141a3.exe	150
PID 1492 set thread context of 5656	1492	Tue11e4e580f2e8141a3.exe	159
PID 1492 set thread context of 4644	1492	Tue11e4e580f2e8141a3.exe	163
PID 1492 set thread context of 6032	1492	Tue11e4e580f2e8141a3.exe	164
PID 1492 set thread context of 5784	1492	Tue11e4e580f2e8141a3.exe	166
PID 1492 set thread context of 1616	1492	Tue11e4e580f2e8141a3.exe	172
PID 1492 set thread context of 5336	1492	Tue11e4e580f2e8141a3.exe	176
PID 1492 set thread context of 840	1492	Tue11e4e580f2e8141a3.exe	178
PID 1492 set thread context of 5092	1492	Tue11e4e580f2e8141a3.exe	181
PID 1492 set thread context of 1752	1492	Tue11e4e580f2e8141a3.exe	185
PID 1492 set thread context of 3668	1492	Tue11e4e580f2e8141a3.exe	189
PID 1492 set thread context of 5596	1492	Tue11e4e580f2e8141a3.exe	198
PID 1492 set thread context of 5580	1492	Tue11e4e580f2e8141a3.exe	199
PID 1492 set thread context of 6048	1492	Tue11e4e580f2e8141a3.exe	207
PID 1492 set thread context of 4208	1492	Tue11e4e580f2e8141a3.exe	210
PID 2124 set thread context of 6084	2124	services64.exe	212
PID 1492 set thread context of 6044	1492	Tue11e4e580f2e8141a3.exe	211
PID 1492 set thread context of 3940	1492	Tue11e4e580f2e8141a3.exe	214
PID 1492 set thread context of 2228	1492	Tue11e4e580f2e8141a3.exe	215
PID 1492 set thread context of 5204	1492	Tue11e4e580f2e8141a3.exe	218
PID 1492 set thread context of 1812	1492	Tue11e4e580f2e8141a3.exe	223
PID 1492 set thread context of 1652	1492	Tue11e4e580f2e8141a3.exe	235
PID 1492 set thread context of 1180	1492	Tue11e4e580f2e8141a3.exe	240
PID 1492 set thread context of 5524	1492	Tue11e4e580f2e8141a3.exe	243
PID 1492 set thread context of 2176	1492	Tue11e4e580f2e8141a3.exe	245
PID 1492 set thread context of 2372	1492	Tue11e4e580f2e8141a3.exe	246
PID 1492 set thread context of 3084	1492	Tue11e4e580f2e8141a3.exe	250
PID 1492 set thread context of 5200	1492	Tue11e4e580f2e8141a3.exe	293
PID 1492 set thread context of 5232	1492	Tue11e4e580f2e8141a3.exe	345
PID 1492 set thread context of 5492	1492	Tue11e4e580f2e8141a3.exe	254
PID 1492 set thread context of 1512	1492	Tue11e4e580f2e8141a3.exe	353
PID 1492 set thread context of 5416	1492	Tue11e4e580f2e8141a3.exe	261
PID 1492 set thread context of 4128	1492	Tue11e4e580f2e8141a3.exe	307
PID 1492 set thread context of 1764	1492	Tue11e4e580f2e8141a3.exe	265
PID 1492 set thread context of 4176	1492	Tue11e4e580f2e8141a3.exe	266
PID 1492 set thread context of 5260	1492	Tue11e4e580f2e8141a3.exe	311
PID 1492 set thread context of 3328	1492	Tue11e4e580f2e8141a3.exe	281
PID 1492 set thread context of 1716	1492	Tue11e4e580f2e8141a3.exe	282
PID 1492 set thread context of 6040	1492	Tue11e4e580f2e8141a3.exe	288
PID 1492 set thread context of 1580	1492	Tue11e4e580f2e8141a3.exe	291
PID 1492 set thread context of 5200	1492	Tue11e4e580f2e8141a3.exe	293
PID 1492 set thread context of 4532	1492	Tue11e4e580f2e8141a3.exe	294
PID 1492 set thread context of 5960	1492	Tue11e4e580f2e8141a3.exe	295
PID 1492 set thread context of 2992	1492	Tue11e4e580f2e8141a3.exe	298
PID 1492 set thread context of 5360	1492	Tue11e4e580f2e8141a3.exe	299
PID 1492 set thread context of 3588	1492	Tue11e4e580f2e8141a3.exe	300
PID 1492 set thread context of 2780	1492	Tue11e4e580f2e8141a3.exe	301
PID 1492 set thread context of 4400	1492	Tue11e4e580f2e8141a3.exe	322
PID 1492 set thread context of 3144	1492	Tue11e4e580f2e8141a3.exe	304
PID 1492 set thread context of 3232	1492	Tue11e4e580f2e8141a3.exe	365
PID 1492 set thread context of 6020	1492	Tue11e4e580f2e8141a3.exe	306
PID 1492 set thread context of 5216	1492	Tue11e4e580f2e8141a3.exe	308
PID 1492 set thread context of 5380	1492	Tue11e4e580f2e8141a3.exe	309
PID 1492 set thread context of 5888	1492	Tue11e4e580f2e8141a3.exe	356
PID 1492 set thread context of 1048	1492	Tue11e4e580f2e8141a3.exe	314
PID 1492 set thread context of 5536	1492	Tue11e4e580f2e8141a3.exe	315
PID 1492 set thread context of 2072	1492	Tue11e4e580f2e8141a3.exe	316
PID 1492 set thread context of 1276	1492	Tue11e4e580f2e8141a3.exe	317
PID 1492 set thread context of 2416	1492	Tue11e4e580f2e8141a3.exe	349
PID 1492 set thread context of 1780	1492	Tue11e4e580f2e8141a3.exe	321

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files\Uninstall Information\DXDXAYVHHM\ultramediaburner.exe	svchost.exe
File created	C:\Program Files\Uninstall Information\DXDXAYVHHM\ultramediaburner.exe.config	svchost.exe
File created	C:\Program Files (x86)\Windows Sidebar\Vudufeshalo.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-23LRS.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-KO0SQ.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows Sidebar\Vudufeshalo.exe.config	svchost.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-Q5G03.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3F28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E2F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF291EBE68476381CF.TMP	msiexec.exe
File created	C:\Windows\Tasks\AdvancedWindowsManager #1.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI4DD0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5640.tmp	msiexec.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Installer\f76362f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5227.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8611.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3B4145DAC38C2107.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AD1.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98DF.tmp	msiexec.exe
File created	C:\Windows\Installer\f76362f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI741D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76DE.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7B9190490BA3DBF5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5526.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI690E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF16DB77939281F6AE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C5B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 22 IoCs

pid	pid_target	Process	procid_target
3896	1812	WerFault.exe	96
3300	1696	WerFault.exe	98
2972	1692	WerFault.exe	99
5756	1780	WerFault.exe	97
3808	5164	WerFault.exe	120
5808	2504	WerFault.exe	122
1640	5208	WerFault.exe	146
1708	5264	WerFault.exe	124
5972	6040	WerFault.exe	168
2968	1168	WerFault.exe	114
5592	5904	WerFault.exe	138
948	840	WerFault.exe	178
4732	5736	WerFault.exe	137
2496	5568	WerFault.exe	162
5624	2944	WerFault.exe	231
3468	3472	WerFault.exe	273
6060	4056	WerFault.exe	285
5876	2072	WerFault.exe	316
5044	1412	WerFault.exe	381
4792	5200	WerFault.exe	393
5484	680	WerFault.exe	415
5496	5264	WerFault.exe	424

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Tue11e4e580f2e8141a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Tue11e4e580f2e8141a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
4772	schtasks.exe
5492	schtasks.exe

Enumerates system info in registry 2 TTPs 47 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Tue11e4e580f2e8141a3.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Tue11e4e580f2e8141a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2776	taskkill.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\7\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	installer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1208	powershell.exe
1208	powershell.exe
3300	WerFault.exe
3300	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
1208	powershell.exe
3896	WerFault.exe
3896	WerFault.exe
5756	WerFault.exe
5756	WerFault.exe
3808	WerFault.exe
3808	WerFault.exe
5808	WerFault.exe
5808	WerFault.exe
1640	WerFault.exe
1640	WerFault.exe
1708	WerFault.exe
1708	WerFault.exe
5968	setup_2.tmp
5968	setup_2.tmp
1168	4643054.exe
1168	4643054.exe
4752	Process not Found
4752	Process not Found
2968	WerFault.exe
2968	WerFault.exe
5972	WerFault.exe
5972	WerFault.exe
4624	Tue11e4e580f2e8141a3.exe
4624	Tue11e4e580f2e8141a3.exe
5904	Tue11e4e580f2e8141a3.exe
5904	Tue11e4e580f2e8141a3.exe
5736	3664001.exe
5736	3664001.exe
5592	WerFault.exe
5592	WerFault.exe
2608	Tue11e4e580f2e8141a3.exe
2608	Tue11e4e580f2e8141a3.exe
948	WerFault.exe
948	WerFault.exe
5612	Tue11e4e580f2e8141a3.exe
5612	Tue11e4e580f2e8141a3.exe
5568	3062523.exe
5568	3062523.exe
4732	WerFault.exe
4732	WerFault.exe
6052	Tue11e4e580f2e8141a3.exe
6052	Tue11e4e580f2e8141a3.exe
5556	4187895.exe
5556	4187895.exe
2316	ultramediaburner.tmp
2316	ultramediaburner.tmp
1016	4579680.exe
1016	4579680.exe
2496	WerFault.exe
2496	WerFault.exe
5664	Tue11e4e580f2e8141a3.exe
5664	Tue11e4e580f2e8141a3.exe
6032	Tue11e4e580f2e8141a3.exe
6032	Tue11e4e580f2e8141a3.exe
5656	Tue11e4e580f2e8141a3.exe
5656	Tue11e4e580f2e8141a3.exe
5784	Tue11e4e580f2e8141a3.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
6112	WinHoster.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1780	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	1780	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	1780	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	1780	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	1780	Tue118f55232e4.exe
Token: SeTcbPrivilege	1780	Tue118f55232e4.exe
Token: SeSecurityPrivilege	1780	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	1780	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	1780	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	1780	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	1780	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	1780	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	1780	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	1780	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	1780	Tue118f55232e4.exe
Token: SeBackupPrivilege	1780	Tue118f55232e4.exe
Token: SeRestorePrivilege	1780	Tue118f55232e4.exe
Token: SeShutdownPrivilege	1780	Tue118f55232e4.exe
Token: SeDebugPrivilege	1780	Tue118f55232e4.exe
Token: SeAuditPrivilege	1780	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	1780	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	1780	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	1780	Tue118f55232e4.exe
Token: SeUndockPrivilege	1780	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	1780	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	1780	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	1780	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	1780	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	1780	Tue118f55232e4.exe
Token: 31	1780	Tue118f55232e4.exe
Token: 32	1780	Tue118f55232e4.exe
Token: 33	1780	Tue118f55232e4.exe
Token: 34	1780	Tue118f55232e4.exe
Token: 35	1780	Tue118f55232e4.exe
Token: SeDebugPrivilege	1420	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	1640	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeRestorePrivilege	3896	WerFault.exe
Token: SeBackupPrivilege	3896	WerFault.exe
Token: SeBackupPrivilege	3896	WerFault.exe
Token: SeDebugPrivilege	1168	4643054.exe
Token: SeDebugPrivilege	1488	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	5164	2.exe
Token: SeDebugPrivilege	5736	3664001.exe
Token: SeDebugPrivilege	6028	cmd.exe
Token: SeDebugPrivilege	5904	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	4624	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	2608	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	5568	3062523.exe
Token: SeDebugPrivilege	5612	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	1988	svchost.exe
Token: SeDebugPrivilege	6052	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	4752	Process not Found
Token: SeDebugPrivilege	5556	4187895.exe
Token: SeDebugPrivilege	5664	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	5656	Tue11e4e580f2e8141a3.exe
Token: SeIncreaseQuotaPrivilege	1208	powershell.exe
Token: SeSecurityPrivilege	1208	powershell.exe
Token: SeTakeOwnershipPrivilege	1208	powershell.exe
Token: SeLoadDriverPrivilege	1208	powershell.exe
Token: SeSystemProfilePrivilege	1208	powershell.exe
Token: SeSystemtimePrivilege	1208	powershell.exe
Token: SeProfSingleProcessPrivilege	1208	powershell.exe
Token: SeIncBasePriorityPrivilege	1208	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5968	setup_2.tmp
2316	ultramediaburner.tmp
476	msedge.exe
2552	installer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3488	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4924	5084	setup_x86_x64_install.exe	79
PID 5084 wrote to memory of 4924	5084	setup_x86_x64_install.exe	79
PID 5084 wrote to memory of 4924	5084	setup_x86_x64_install.exe	79
PID 4924 wrote to memory of 4748	4924	setup_installer.exe	80
PID 4924 wrote to memory of 4748	4924	setup_installer.exe	80
PID 4924 wrote to memory of 4748	4924	setup_installer.exe	80
PID 4748 wrote to memory of 3016	4748	setup_install.exe	84
PID 4748 wrote to memory of 3016	4748	setup_install.exe	84
PID 4748 wrote to memory of 3016	4748	setup_install.exe	84
PID 4748 wrote to memory of 1632	4748	setup_install.exe	85
PID 4748 wrote to memory of 1632	4748	setup_install.exe	85
PID 4748 wrote to memory of 1632	4748	setup_install.exe	85
PID 4748 wrote to memory of 5100	4748	setup_install.exe	86
PID 4748 wrote to memory of 5100	4748	setup_install.exe	86
PID 4748 wrote to memory of 5100	4748	setup_install.exe	86
PID 4748 wrote to memory of 3220	4748	setup_install.exe	87
PID 4748 wrote to memory of 3220	4748	setup_install.exe	87
PID 4748 wrote to memory of 3220	4748	setup_install.exe	87
PID 4748 wrote to memory of 5092	4748	setup_install.exe	88
PID 4748 wrote to memory of 5092	4748	setup_install.exe	88
PID 4748 wrote to memory of 5092	4748	setup_install.exe	88
PID 4748 wrote to memory of 3540	4748	setup_install.exe	95
PID 4748 wrote to memory of 3540	4748	setup_install.exe	95
PID 4748 wrote to memory of 3540	4748	setup_install.exe	95
PID 4748 wrote to memory of 4552	4748	setup_install.exe	89
PID 4748 wrote to memory of 4552	4748	setup_install.exe	89
PID 4748 wrote to memory of 4552	4748	setup_install.exe	89
PID 4748 wrote to memory of 824	4748	setup_install.exe	90
PID 4748 wrote to memory of 824	4748	setup_install.exe	90
PID 4748 wrote to memory of 824	4748	setup_install.exe	90
PID 4748 wrote to memory of 888	4748	setup_install.exe	94
PID 4748 wrote to memory of 888	4748	setup_install.exe	94
PID 4748 wrote to memory of 888	4748	setup_install.exe	94
PID 4748 wrote to memory of 444	4748	setup_install.exe	93
PID 4748 wrote to memory of 444	4748	setup_install.exe	93
PID 4748 wrote to memory of 444	4748	setup_install.exe	93
PID 1632 wrote to memory of 468	1632	cmd.exe	91
PID 1632 wrote to memory of 468	1632	cmd.exe	91
PID 1632 wrote to memory of 468	1632	cmd.exe	91
PID 3016 wrote to memory of 1208	3016	cmd.exe	92
PID 3016 wrote to memory of 1208	3016	cmd.exe	92
PID 3016 wrote to memory of 1208	3016	cmd.exe	92
PID 3220 wrote to memory of 1420	3220	cmd.exe	103
PID 3220 wrote to memory of 1420	3220	cmd.exe	103
PID 824 wrote to memory of 1640	824	cmd.exe	100
PID 824 wrote to memory of 1640	824	cmd.exe	100
PID 4552 wrote to memory of 1492	4552	cmd.exe	101
PID 4552 wrote to memory of 1492	4552	cmd.exe	101
PID 4552 wrote to memory of 1492	4552	cmd.exe	101
PID 5092 wrote to memory of 1696	5092	cmd.exe	98
PID 5092 wrote to memory of 1696	5092	cmd.exe	98
PID 5092 wrote to memory of 1696	5092	cmd.exe	98
PID 5100 wrote to memory of 1472	5100	cmd.exe	102
PID 5100 wrote to memory of 1472	5100	cmd.exe	102
PID 5100 wrote to memory of 1472	5100	cmd.exe	102
PID 444 wrote to memory of 1692	444	cmd.exe	99
PID 444 wrote to memory of 1692	444	cmd.exe	99
PID 444 wrote to memory of 1692	444	cmd.exe	99
PID 3540 wrote to memory of 1812	3540	cmd.exe	96
PID 3540 wrote to memory of 1812	3540	cmd.exe	96
PID 3540 wrote to memory of 1812	3540	cmd.exe	96
PID 888 wrote to memory of 1780	888	cmd.exe	97
PID 888 wrote to memory of 1780	888	cmd.exe	97
PID 888 wrote to memory of 1780	888	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        
        PID:468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\is-M04ON.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-M04ON.tmp\Tue11b9d76a96506.tmp" /SL5="$30162,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\is-GBAFG.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-GBAFG.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Program Files\Uninstall Information\DXDXAYVHHM\ultramediaburner.exe
        
        "C:\Program Files\Uninstall Information\DXDXAYVHHM\ultramediaburner.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\is-HGLQA.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HGLQA.tmp\ultramediaburner.tmp" /SL5="$6022A,281924,62464,C:\Program Files\Uninstall Information\DXDXAYVHHM\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2316
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\94-c5593-a8a-f99af-a99562f26bdf8\Laluhaqera.exe
        
        "C:\Users\Admin\AppData\Local\Temp\94-c5593-a8a-f99af-a99562f26bdf8\Laluhaqera.exe"
        8⤵
        Executes dropped EXE
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Adds Run key to start application
        Enumerates system info in registry
        Suspicious use of FindShellTrayWindow
        
        PID:476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ffd3de246f8,0x7ffd3de24708,0x7ffd3de24718
        10⤵
        
        PID:3788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        10⤵
        
        PID:4064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
        10⤵
        
        PID:248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
        10⤵
        
        PID:252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        10⤵
        
        PID:3024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
        10⤵
        
        PID:2504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
        10⤵
        
        PID:4876
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
        10⤵
        
        PID:472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
        10⤵
        
        PID:5804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
        10⤵
        
        PID:2628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
        10⤵
        
        PID:3172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1276 /prefetch:2
        10⤵
        
        PID:784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
        10⤵
        
        PID:4596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5348 /prefetch:8
        10⤵
        
        PID:4400
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:8
        10⤵
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2404 /prefetch:1
        10⤵
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6100 /prefetch:8
        10⤵
        
        PID:4628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,3903955557589171872,14300849457142802833,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5416 /prefetch:8
        10⤵
        
        PID:3588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:2964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3de246f8,0x7ffd3de24708,0x7ffd3de24718
        10⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\2e-24141-6a4-41b8d-e6722c546087d\Xavyxywile.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2e-24141-6a4-41b8d-e6722c546087d\Xavyxywile.exe"
        8⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ocueel04.ulp\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\ocueel04.ulp\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\ocueel04.ulp\GcleanerEU.exe /eufive
        10⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 236
        11⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5624
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\10iado24.aad\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\10iado24.aad\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\10iado24.aad\installer.exe /qn CAMPAIGN="654"
        10⤵
        Loads dropped DLL
        Enumerates connected drives
        Modifies system certificate store
        Suspicious use of FindShellTrayWindow
        
        PID:2552
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\10iado24.aad\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\10iado24.aad\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630849906 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        Enumerates connected drives
        
        PID:4112
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s0atwers.xfc\anyname.exe & exit
        9⤵
        Blocklisted process makes network request
        Suspicious use of AdjustPrivilegeToken
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\s0atwers.xfc\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\s0atwers.xfc\anyname.exe
        10⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\s0atwers.xfc\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\s0atwers.xfc\anyname.exe" -u
        11⤵
        
        PID:3508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tj55om00.i1z\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:2776
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        10⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\tj55om00.i1z\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\tj55om00.i1z\gcleaner.exe /mixfive
        10⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 236
        11⤵
        Program crash
        
        PID:3468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bwxnxisw.xjr\autosubplayer.exe /S & exit
        9⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1420
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:5412
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:4772
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2124
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2460
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:5492
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:6036
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
        
        C:\Users\Admin\AppData\Roaming\4901238.exe
        
        "C:\Users\Admin\AppData\Roaming\4901238.exe"
        8⤵
        
        PID:5904
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5904 -s 2328
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5592
        
        C:\Users\Admin\AppData\Roaming\1002020.exe
        
        "C:\Users\Admin\AppData\Roaming\1002020.exe"
        8⤵
        Executes dropped EXE
        
        PID:5992
        
        C:\Users\Admin\AppData\Roaming\4579680.exe
        
        "C:\Users\Admin\AppData\Roaming\4579680.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1016
        
        C:\Users\Admin\AppData\Roaming\7546020.exe
        
        "C:\Users\Admin\AppData\Roaming\7546020.exe"
        8⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4944
        
        C:\Users\Admin\AppData\Roaming\3062523.exe
        
        "C:\Users\Admin\AppData\Roaming\3062523.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 2408
        9⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5164
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5164 -s 1728
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 288
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:5264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 604
        8⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\is-27NT9.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-27NT9.tmp\setup_2.tmp" /SL5="$401F4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\is-04M5C.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-04M5C.tmp\setup_2.tmp" /SL5="$501F4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        
        PID:6028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 280
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        Tue11e4e580f2e8141a3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Loads dropped DLL
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:392
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1104
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 28
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
      - C:\ProgramData\4643054.exe
        
        "C:\ProgramData\4643054.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1168 -s 2380
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2968
      - C:\ProgramData\178360.exe
        
        "C:\ProgramData\178360.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:3700
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:6112
      - C:\ProgramData\4895983.exe
        
        "C:\ProgramData\4895983.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5224
      - C:\ProgramData\4187895.exe
        
        "C:\ProgramData\4187895.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556
      - C:\ProgramData\3664001.exe
        
        "C:\ProgramData\3664001.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 2424
        7⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        
        PID:1692
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 288
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 1656
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\7zSC33148F3\Tue11bc0507b56295.exe
        
        Tue11bc0507b56295.exe
        5⤵
        Executes dropped EXE
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 284
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3896

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv qZIHR0hrq02NvNbKVX1Y/g.0.2
1⤵
- Modifies data under HKEY_USERS
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1812 -ip 1812
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1696 -ip 1696
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1692 -ip 1692
1⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1780 -ip 1780
1⤵
PID:5592

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 5164 -ip 5164
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4872

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5208 -s 424
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5208 -ip 5208
1⤵
PID:476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2504 -ip 2504
1⤵
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5264 -ip 5264
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5404

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 452
    3⤵
    - Program crash
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5972

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 1168 -ip 1168
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6040 -ip 6040
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5780

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 5904 -ip 5904
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 840 -ip 840
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5736 -ip 5736
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5568 -ip 5568
1⤵
PID:5652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2944 -ip 2944
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1772
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 79F63AA4889CE5372D3838E9654F107B C
  2⤵
  - Loads dropped DLL
  PID:5800
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EB6B25CE46A59C3AD6D1F64F7E8C0DB7
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2104
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:2776
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6ADC82318DD36F7AC1ED3C407E1AE55A E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:5124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3472 -ip 3472
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4280

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 460
    3⤵
    - Program crash
    - Enumerates system info in registry
    PID:6060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4056 -ip 4056
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2072 -ip 2072
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1412 -ip 1412
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:6040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5200 -ip 5200
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 680 -ip 680
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5264 -ip 5264
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

System Information Discovery