amadey | 7941e3ad78b3fee9fcf4f17f43845c5ad33a1803b41576832c85327386416e05

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	5DD1do9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	A141.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	A73E.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 28 IoCs

pid	Process
1984	xX1IB79.exe
876	jP2HP61.exe
1784	Lb6ct54.exe
2244	1rZ85Xs3.exe
2164	2bF8433.exe
4792	3Ce35VX.exe
5116	4VX959Jf.exe
3940	5DD1do9.exe
2028	68A8.exe
4644	Xo2RA0ZJ.exe
4540	81BF.exe
3024	Fs2ad9zq.exe
552	8FAB.exe
2280	9579.exe
4920	sh8Vb5ow.exe
4616	A141.exe
2600	QC6IL7Mr.exe
1548	A73E.exe
1972	1WW02aY9.exe
452	AA8A.exe
3256	AC7F.exe
2244	explothe.exe
4888	oneetx.exe
4092	B327.exe
1028	BFFA.exe
5716	2UA109pk.exe
4792	explothe.exe
1300	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
5888	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Fs2ad9zq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Lb6ct54.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	68A8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Xo2RA0ZJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	sh8Vb5ow.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\""	QC6IL7Mr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	xX1IB79.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	jP2HP61.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 2236	2244	1rZ85Xs3.exe	91
PID 2164 set thread context of 4760	2164	2bF8433.exe	102
PID 4792 set thread context of 3056	4792	3Ce35VX.exe	110
PID 5116 set thread context of 4804	5116	4VX959Jf.exe	120
PID 1028 set thread context of 5460	1028	BFFA.exe	177
PID 4540 set thread context of 5708	4540	81BF.exe	207
PID 552 set thread context of 5380	552	8FAB.exe	213
PID 1972 set thread context of 6044	1972	1WW02aY9.exe	216

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
2056	2244	WerFault.exe	89
2732	2164	WerFault.exe	98
3324	4760	WerFault.exe	102
3760	4792	WerFault.exe	107
2512	5116	WerFault.exe	113
5328	4540	WerFault.exe	127
5372	552	WerFault.exe	132
4064	1972	WerFault.exe	141
2532	6044	WerFault.exe	216

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
2808	schtasks.exe
2796	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	AppLaunch.exe
2236	AppLaunch.exe
2236	AppLaunch.exe
3056	AppLaunch.exe
3056	AppLaunch.exe
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found
1084	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1084	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3056	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	AppLaunch.exe
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeDebugPrivilege	2280	msedge.exe
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeDebugPrivilege	3256	AC7F.exe
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found
Token: SeCreatePagefilePrivilege	1084	Process not Found
Token: SeShutdownPrivilege	1084	Process not Found

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1548	A73E.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1084	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1984	4064	file.exe	86
PID 4064 wrote to memory of 1984	4064	file.exe	86
PID 4064 wrote to memory of 1984	4064	file.exe	86
PID 1984 wrote to memory of 876	1984	xX1IB79.exe	87
PID 1984 wrote to memory of 876	1984	xX1IB79.exe	87
PID 1984 wrote to memory of 876	1984	xX1IB79.exe	87
PID 876 wrote to memory of 1784	876	jP2HP61.exe	88
PID 876 wrote to memory of 1784	876	jP2HP61.exe	88
PID 876 wrote to memory of 1784	876	jP2HP61.exe	88
PID 1784 wrote to memory of 2244	1784	Lb6ct54.exe	89
PID 1784 wrote to memory of 2244	1784	Lb6ct54.exe	89
PID 1784 wrote to memory of 2244	1784	Lb6ct54.exe	89
PID 2244 wrote to memory of 628	2244	1rZ85Xs3.exe	90
PID 2244 wrote to memory of 628	2244	1rZ85Xs3.exe	90
PID 2244 wrote to memory of 628	2244	1rZ85Xs3.exe	90
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 2244 wrote to memory of 2236	2244	1rZ85Xs3.exe	91
PID 1784 wrote to memory of 2164	1784	Lb6ct54.exe	98
PID 1784 wrote to memory of 2164	1784	Lb6ct54.exe	98
PID 1784 wrote to memory of 2164	1784	Lb6ct54.exe	98
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 2164 wrote to memory of 4760	2164	2bF8433.exe	102
PID 876 wrote to memory of 4792	876	jP2HP61.exe	107
PID 876 wrote to memory of 4792	876	jP2HP61.exe	107
PID 876 wrote to memory of 4792	876	jP2HP61.exe	107
PID 4792 wrote to memory of 2256	4792	3Ce35VX.exe	109
PID 4792 wrote to memory of 2256	4792	3Ce35VX.exe	109
PID 4792 wrote to memory of 2256	4792	3Ce35VX.exe	109
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 4792 wrote to memory of 3056	4792	3Ce35VX.exe	110
PID 1984 wrote to memory of 5116	1984	xX1IB79.exe	113
PID 1984 wrote to memory of 5116	1984	xX1IB79.exe	113
PID 1984 wrote to memory of 5116	1984	xX1IB79.exe	113
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 5116 wrote to memory of 4804	5116	4VX959Jf.exe	120
PID 4064 wrote to memory of 3940	4064	file.exe	124
PID 4064 wrote to memory of 3940	4064	file.exe	124
PID 4064 wrote to memory of 3940	4064	file.exe	124
PID 1084 wrote to memory of 2028	1084	Process not Found	125
PID 1084 wrote to memory of 2028	1084	Process not Found	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xX1IB79.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xX1IB79.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jP2HP61.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jP2HP61.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Lb6ct54.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Lb6ct54.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rZ85Xs3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1rZ85Xs3.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2244
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:628
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 588
        6⤵
        Program crash
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2bF8433.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2bF8433.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2164
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 548
        7⤵
        Program crash
        
        PID:3324
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 148
        6⤵
        Program crash
        
        PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Ce35VX.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Ce35VX.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2256
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3056
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 572
        5⤵
        Program crash
        
        PID:3760
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4VX959Jf.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4VX959Jf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 136
      4⤵
      Program crash
      PID:2512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5DD1do9.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5DD1do9.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3940
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8095.tmp\8096.tmp\8097.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5DD1do9.exe"
    3⤵
    PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
        5⤵
        
        PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
      4⤵
      PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
        5⤵
        
        PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
        5⤵
        
        PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2244 -ip 2244
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2164 -ip 2164
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4760 -ip 4760
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4792 -ip 4792
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5116 -ip 5116
1⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\68A8.exe
C:\Users\Admin\AppData\Local\Temp\68A8.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2028
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Xo2RA0ZJ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Xo2RA0ZJ.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4644
- - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Fs2ad9zq.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Fs2ad9zq.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\sh8Vb5ow.exe
      C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\sh8Vb5ow.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\QC6IL7Mr.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\QC6IL7Mr.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1WW02aY9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1WW02aY9.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1972
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 540
        8⤵
        Program crash
        
        PID:2532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 148
        7⤵
        Program crash
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2UA109pk.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2UA109pk.exe
        6⤵
        Executes dropped EXE
        
        PID:5716

C:\Users\Admin\AppData\Local\Temp\81BF.exe
C:\Users\Admin\AppData\Local\Temp\81BF.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 288
  2⤵
  - Program crash
  PID:5328

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8BF1.bat" "
1⤵
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
    3⤵
    PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7884 /prefetch:8
    3⤵
    PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7884 /prefetch:8
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2228,16190845851567171588,7377146762957599419,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7364 /prefetch:8
    3⤵
    PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:3972

C:\Users\Admin\AppData\Local\Temp\8FAB.exe
C:\Users\Admin\AppData\Local\Temp\8FAB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 272
  2⤵
  - Program crash
  PID:5372

C:\Users\Admin\AppData\Local\Temp\9579.exe
C:\Users\Admin\AppData\Local\Temp\9579.exe
1⤵
- Executes dropped EXE
PID:2280

C:\Users\Admin\AppData\Local\Temp\A141.exe
C:\Users\Admin\AppData\Local\Temp\A141.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4616
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2244
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2476
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:5216
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:6088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:4108
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:5236
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    PID:5888

C:\Users\Admin\AppData\Local\Temp\A73E.exe
C:\Users\Admin\AppData\Local\Temp\A73E.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1548
- C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
    3⤵
    PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5312
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:5468
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5356
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:N"
      4⤵
      PID:5556
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:R" /E
      4⤵
      PID:212
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2796

C:\Users\Admin\AppData\Local\Temp\AA8A.exe
C:\Users\Admin\AppData\Local\Temp\AA8A.exe
1⤵
- Executes dropped EXE
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=AA8A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xe0,0x104,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
    3⤵
    PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=AA8A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
    3⤵
    PID:6124

C:\Users\Admin\AppData\Local\Temp\AC7F.exe
C:\Users\Admin\AppData\Local\Temp\AC7F.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Users\Admin\AppData\Local\Temp\B327.exe
C:\Users\Admin\AppData\Local\Temp\B327.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe752646f8,0x7ffe75264708,0x7ffe75264718
1⤵
PID:1720

C:\Users\Admin\AppData\Local\Temp\BFFA.exe
C:\Users\Admin\AppData\Local\Temp\BFFA.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:5460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4540 -ip 4540
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 552 -ip 552
1⤵
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1972 -ip 1972
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6044 -ip 6044
1⤵
PID:3064

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery