amadey | b695ad94565fb8b3e343f4d8636369f6acf45a9d2081c4aef87dff845c092a94

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	5pE7ch5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	AD16.bat
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	B4BA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	explothe.exe

Executes dropped EXE 20 IoCs

pid	Process
4648	hj9sE16.exe
4492	qJ4is96.exe
3356	VO2NX62.exe
1148	1Dp81oC4.exe
5108	2xP7582.exe
1840	3tp40Jg.exe
488	4Ig091wq.exe
4320	5pE7ch5.exe
3760	A88F.exe
4024	Xc2iZ4gs.exe
1924	tu5pz8Jo.exe
2864	AC1B.exe
3188	zu2xh1lo.exe
2912	LR3bz4mR.exe
3232	AD16.bat
868	1jp23xK3.exe
2688	B053.exe
492	B1DA.exe
2832	B4BA.exe
2908	explothe.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	A88F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	tu5pz8Jo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	zu2xh1lo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hj9sE16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	qJ4is96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	VO2NX62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Xc2iZ4gs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	LR3bz4mR.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1148 set thread context of 116	1148	1Dp81oC4.exe	90
PID 5108 set thread context of 2788	5108	2xP7582.exe	97
PID 1840 set thread context of 1096	1840	3tp40Jg.exe	105
PID 488 set thread context of 1956	488	4Ig091wq.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3900	1148	WerFault.exe	89
4176	5108	WerFault.exe	95
1536	2788	WerFault.exe	97
5020	1840	WerFault.exe	104
4208	488	WerFault.exe	108
3572	2864	WerFault.exe	142
5176	868	WerFault.exe	146
5188	3856	WerFault.exe	162
5364	2688	WerFault.exe	147
2444	5988	WerFault.exe	188

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4628	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	AppLaunch.exe
116	AppLaunch.exe
1096	AppLaunch.exe
1096	AppLaunch.exe
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found
3148	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1096	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	AppLaunch.exe
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeShutdownPrivilege	3148	Process not Found
Token: SeCreatePagefilePrivilege	3148	Process not Found
Token: SeDebugPrivilege	492	B1DA.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4648	4968	file.exe	86
PID 4968 wrote to memory of 4648	4968	file.exe	86
PID 4968 wrote to memory of 4648	4968	file.exe	86
PID 4648 wrote to memory of 4492	4648	hj9sE16.exe	87
PID 4648 wrote to memory of 4492	4648	hj9sE16.exe	87
PID 4648 wrote to memory of 4492	4648	hj9sE16.exe	87
PID 4492 wrote to memory of 3356	4492	qJ4is96.exe	88
PID 4492 wrote to memory of 3356	4492	qJ4is96.exe	88
PID 4492 wrote to memory of 3356	4492	qJ4is96.exe	88
PID 3356 wrote to memory of 1148	3356	VO2NX62.exe	89
PID 3356 wrote to memory of 1148	3356	VO2NX62.exe	89
PID 3356 wrote to memory of 1148	3356	VO2NX62.exe	89
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 1148 wrote to memory of 116	1148	1Dp81oC4.exe	90
PID 3356 wrote to memory of 5108	3356	VO2NX62.exe	95
PID 3356 wrote to memory of 5108	3356	VO2NX62.exe	95
PID 3356 wrote to memory of 5108	3356	VO2NX62.exe	95
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 5108 wrote to memory of 2788	5108	2xP7582.exe	97
PID 4492 wrote to memory of 1840	4492	qJ4is96.exe	104
PID 4492 wrote to memory of 1840	4492	qJ4is96.exe	104
PID 4492 wrote to memory of 1840	4492	qJ4is96.exe	104
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 1840 wrote to memory of 1096	1840	3tp40Jg.exe	105
PID 4648 wrote to memory of 488	4648	hj9sE16.exe	108
PID 4648 wrote to memory of 488	4648	hj9sE16.exe	108
PID 4648 wrote to memory of 488	4648	hj9sE16.exe	108
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 488 wrote to memory of 1956	488	4Ig091wq.exe	113
PID 4968 wrote to memory of 4320	4968	file.exe	116
PID 4968 wrote to memory of 4320	4968	file.exe	116
PID 4968 wrote to memory of 4320	4968	file.exe	116
PID 4320 wrote to memory of 4296	4320	5pE7ch5.exe	117
PID 4320 wrote to memory of 4296	4320	5pE7ch5.exe	117
PID 4296 wrote to memory of 2268	4296	cmd.exe	120
PID 4296 wrote to memory of 2268	4296	cmd.exe	120
PID 2268 wrote to memory of 3940	2268	msedge.exe	121
PID 2268 wrote to memory of 3940	2268	msedge.exe	121
PID 4296 wrote to memory of 5084	4296	cmd.exe	122
PID 4296 wrote to memory of 5084	4296	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hj9sE16.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hj9sE16.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qJ4is96.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qJ4is96.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VO2NX62.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\VO2NX62.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dp81oC4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Dp81oC4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 564
        6⤵
        Program crash
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2xP7582.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2xP7582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 200
        7⤵
        Program crash
        
        PID:1536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 208
        6⤵
        Program crash
        
        PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tp40Jg.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3tp40Jg.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 204
        5⤵
        Program crash
        
        PID:5020
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ig091wq.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Ig091wq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:488
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 544
      4⤵
      Program crash
      PID:4208
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pE7ch5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pE7ch5.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4D11.tmp\4D12.tmp\4D13.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5pE7ch5.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7fff4da146f8,0x7fff4da14708,0x7fff4da14718
        5⤵
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16667181246104111509,7098173534764678070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        
        PID:3524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16667181246104111509,7098173534764678070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7fff4da146f8,0x7fff4da14708,0x7fff4da14718
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
        5⤵
        
        PID:2212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:2792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        5⤵
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
        5⤵
        
        PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:2484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
        5⤵
        
        PID:3596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
        5⤵
        
        PID:488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
        5⤵
        
        PID:4968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
        5⤵
        
        PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        
        PID:5532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,8072969978383765072,7864141807364699508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
        5⤵
        
        PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1148 -ip 1148
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5108 -ip 5108
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2788 -ip 2788
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1840 -ip 1840
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 488 -ip 488
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Users\Admin\AppData\Local\Temp\A88F.exe
C:\Users\Admin\AppData\Local\Temp\A88F.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xc2iZ4gs.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xc2iZ4gs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4024
- - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tu5pz8Jo.exe
    C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tu5pz8Jo.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zu2xh1lo.exe
      C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zu2xh1lo.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LR3bz4mR.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LR3bz4mR.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1jp23xK3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1jp23xK3.exe
        6⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 540
        8⤵
        Program crash
        
        PID:5188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 568
        7⤵
        Program crash
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vg272bD.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Vg272bD.exe
        6⤵
        
        PID:5324

C:\Users\Admin\AppData\Local\Temp\AC1B.exe
C:\Users\Admin\AppData\Local\Temp\AC1B.exe
1⤵
- Executes dropped EXE
PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 264
  2⤵
  - Program crash
  PID:3572

C:\Users\Admin\AppData\Local\Temp\AD16.bat
"C:\Users\Admin\AppData\Local\Temp\AD16.bat"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3232
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AEB9.tmp\AEBA.tmp\AEBB.bat C:\Users\Admin\AppData\Local\Temp\AD16.bat"
  2⤵
  PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4da146f8,0x7fff4da14708,0x7fff4da14718
      4⤵
      PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
    3⤵
    PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff4da146f8,0x7fff4da14708,0x7fff4da14718
      4⤵
      PID:5652

C:\Users\Admin\AppData\Local\Temp\B053.exe
C:\Users\Admin\AppData\Local\Temp\B053.exe
1⤵
- Executes dropped EXE
PID:2688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 248
  2⤵
  - Program crash
  PID:5364

C:\Users\Admin\AppData\Local\Temp\B1DA.exe
C:\Users\Admin\AppData\Local\Temp\B1DA.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:492

C:\Users\Admin\AppData\Local\Temp\B4BA.exe
C:\Users\Admin\AppData\Local\Temp\B4BA.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2832
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2908
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - DcRat
    - Creates scheduled task(s)
    PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:1384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5136
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:5204
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:5624
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5844
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2864 -ip 2864
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 868 -ip 868
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3856 -ip 3856
1⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2688 -ip 2688
1⤵
PID:5288

C:\Users\Admin\AppData\Local\Temp\F6B5.exe
C:\Users\Admin\AppData\Local\Temp\F6B5.exe
1⤵
PID:5920
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:6052
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:5232
- C:\Users\Admin\AppData\Local\Temp\kos1.exe
  "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
  2⤵
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\is-QT7G5.tmp\is-AKCR9.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QT7G5.tmp\is-AKCR9.tmp" /SL4 $30264 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\kos.exe
    "C:\Users\Admin\AppData\Local\Temp\kos.exe"
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  PID:5192

C:\Users\Admin\AppData\Local\Temp\FC15.exe
C:\Users\Admin\AppData\Local\Temp\FC15.exe
1⤵
PID:5988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 792
  2⤵
  - Program crash
  PID:2444

C:\Users\Admin\AppData\Local\Temp\FD9D.exe
C:\Users\Admin\AppData\Local\Temp\FD9D.exe
1⤵
PID:6136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5988 -ip 5988
1⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\773.exe
C:\Users\Admin\AppData\Local\Temp\773.exe
1⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\290.exe
C:\Users\Admin\AppData\Local\Temp\290.exe
1⤵
PID:4680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3744

C:\Users\Admin\AppData\Local\Temp\B4C.exe
C:\Users\Admin\AppData\Local\Temp\B4C.exe
1⤵
PID:5780

C:\Users\Admin\AppData\Local\Temp\D70.exe
C:\Users\Admin\AppData\Local\Temp\D70.exe
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery