amadey | 71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	58da931bf9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	H9TU4oY.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3684d0c688.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f91a0abc2c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a7742b4376.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/37240-1181-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/37240-1180-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/37240-1179-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/37240-1178-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral1/memory/37240-1177-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3684d0c688.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3684d0c688.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f91a0abc2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	H9TU4oY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	58da931bf9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a7742b4376.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	H9TU4oY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	58da931bf9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f91a0abc2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a7742b4376.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk	FvrxD1t0NgnacVGo.exe

Executes dropped EXE 64 IoCs

pid	Process
2716	skotes.exe
3008	94CwbGg.exe
1532	H9TU4oY.exe
2452	ShtrayEasy35.exe
1692	FvrxD1t0NgnacVGo.exe
2160	QeoOFLXB1dzqos78.exe
1812	VHGLBZ9EUPwJbzBM.exe
2096	BXnySNbOjuH7FYqb.exe
2284	qcMYfA4dVWqCLkO2.exe
1512	tfH30BxtW8vGHtxp.exe
2276	Gwp3uvtZjr2WgZSj.exe
2892	1MJ3OAKVCFCqm2Os.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
7248	492e27e0fc.exe
13540	m3zpmORN4GRJcldI.exe
13604	MNdirSTaa4p8SC4h.exe
13572	OhiiOCcga3BO9uMg.exe
7832	da3b2817bc.exe
15468	Mjht38a6WnZUtcaq.exe
7080	a55332af62.exe
20344	7z.exe
20376	oLzuj5YkDiUr4GoZ.exe
20404	da3b2817bc.exe
4444	da3b2817bc.exe
9008	da3b2817bc.exe
16676	xqx9MLDJbezTZyED.exe
16728	rIbegFnfAtQ82pOn.exe
22524	7z.exe
14532	58da931bf9.exe
8480	7z.exe
14588	7z.exe
8760	7z.exe
13288	cSvhasBz9tzErqfc.exe
14784	7z.exe
15036	mrCtcGEomQ1xOptZ.exe
1684	7z.exe
21196	O2wNY3JiAvfFdiKO.exe
21540	n4qZLjavj8B7MVkz.exe
21048	7z.exe
22080	zdt58slRKIa24RlE.exe
4072	rIJdZ8vYj5g9Ju64.exe
21364	xv7D8njCc0CvJZmX.exe
22016	9n2egXzGV2Ko9etY.exe
22384	bQk5aoVdBPLlnLQ0.exe
20132	in.exe
16228	3684d0c688.exe
17220	596166adff.exe
5796	Px9Y96ETeHz1kv8q.exe
9560	blnUILwlcguqnE0C.exe
2696	PLainWkRTD33uIEh.exe
10128	sid1h3y10Z5latjY.exe
10004	q2IGBmrrlk6mkw4D.exe
21816	1xCkrZR2ihgx9jyX.exe
12484	FKc86Qa8Mx9Qlz0A.exe
7208	u78FsTSyWjK5HVni.exe
1804	hY3hWqmdTbuOdyOK.exe
13148	7ID9ZeTs209m8hr2.exe
12832	uqgpnpYNAadwKV9S.exe
12072	f91a0abc2c.exe
13192	SurnWrPmoqP4Cgsh.exe
2960	o6atSNdeVvoRfGID.exe
12088	VTQYPRyI307E6zKH.exe
12108	7qFju6o2mNBuTGHs.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	H9TU4oY.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	58da931bf9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	3684d0c688.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	f91a0abc2c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	a7742b4376.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
Key opened	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe

Loads dropped DLL 64 IoCs

pid	Process
2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
2716	skotes.exe
3020	MsiExec.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
1564	rundll32.exe
2716	skotes.exe
2716	skotes.exe
2716	skotes.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
1692	FvrxD1t0NgnacVGo.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
11440	WerFault.exe
11440	WerFault.exe
11440	WerFault.exe
2716	skotes.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
2452	ShtrayEasy35.exe
7796	WerFault.exe
7796	WerFault.exe
7796	WerFault.exe
6328	WerFault.exe
6328	WerFault.exe
6328	WerFault.exe
13524	WerFault.exe
13524	WerFault.exe
13524	WerFault.exe
6840	WerFault.exe
6840	WerFault.exe
6840	WerFault.exe
7796	WerFault.exe
11440	WerFault.exe
8568	WerFault.exe
8568	WerFault.exe
8568	WerFault.exe
13412	WerFault.exe
13412	WerFault.exe
13412	WerFault.exe
6328	WerFault.exe
13524	WerFault.exe
2716	skotes.exe
2716	skotes.exe
6980	WerFault.exe
6980	WerFault.exe
6980	WerFault.exe
21676	WerFault.exe
21676	WerFault.exe
21676	WerFault.exe
6840	WerFault.exe
2452	ShtrayEasy35.exe
15456	WerFault.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	f91a0abc2c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\596166adff.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015599001\\596166adff.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\f91a0abc2c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015600001\\f91a0abc2c.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleChrome = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uW4uel75\\FvrxD1t0NgnacVGo.exe"	FvrxD1t0NgnacVGo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\58da931bf9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015597001\\58da931bf9.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\3684d0c688.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1015598001\\3684d0c688.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001c87d-452.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
2716	skotes.exe
1532	H9TU4oY.exe
14532	58da931bf9.exe
16228	3684d0c688.exe
12072	f91a0abc2c.exe
21580	a7742b4376.exe
10988	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
37736	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 7832 set thread context of 9008	7832	da3b2817bc.exe	80

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/20132-414-0x000000013F900000-0x000000013FD90000-memory.dmp	upx
behavioral1/memory/23168-973-0x000000013FF40000-0x00000001403D0000-memory.dmp	upx
behavioral1/memory/23168-1055-0x000000013FF40000-0x00000001403D0000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
11440	2276	WerFault.exe	48
7796	2284	WerFault.exe	49
13524	1512	WerFault.exe	51
6328	2892	WerFault.exe	50
6840	2160	WerFault.exe	45
8568	13572	WerFault.exe	59
13412	1812	WerFault.exe	46
6980	13540	WerFault.exe	58
21676	13604	WerFault.exe	60
15456	1036	WerFault.exe	52
20300	15468	WerFault.exe	70
16852	20376	WerFault.exe	77
10144	16728	WerFault.exe	82
20672	13288	WerFault.exe	89
20796	1692	WerFault.exe	44
5988	2096	WerFault.exe	47
21632	16676	WerFault.exe	81
13152	15036	WerFault.exe	91
5840	21540	WerFault.exe	99
3472	21196	WerFault.exe	97
8016	22384	WerFault.exe	102
16804	9560	WerFault.exe
3352	5796	WerFault.exe
4748	10128	WerFault.exe	129
3020	21364	WerFault.exe	98
27196	2696	WerFault.exe	124
27100	13148	WerFault.exe	135
23096	22016	WerFault.exe	100
7900	22080	WerFault.exe	101
13416	7208	WerFault.exe	132
20884	13192	WerFault.exe	139
27540	12484	WerFault.exe	133
12856	1804	WerFault.exe	134
8640	10004	WerFault.exe	130
7228	12832	WerFault.exe	136
19776	2960	WerFault.exe	141
2964	4072	WerFault.exe	103
20156	12108	WerFault.exe	143
4304	12088	WerFault.exe	142
46820	27208	WerFault.exe	153
7964	552	WerFault.exe	53
46532	6616	WerFault.exe	157
39772	13608	WerFault.exe	147
39576	22000	WerFault.exe	148
19396	344	WerFault.exe	145
5052	23508	WerFault.exe	155
15176	17632	WerFault.exe	183
17316	20724	WerFault.exe	163
16284	19664	WerFault.exe	184
6400	20344	WerFault.exe	182
27192	21520	WerFault.exe	160
21176	12768	WerFault.exe	195
7160	9380	WerFault.exe	194
21200	20240	WerFault.exe	192
13376	4060	WerFault.exe	193
2020	19400	WerFault.exe	190
11084	12376	WerFault.exe	191
38864	23460	WerFault.exe	154
32080	19576	WerFault.exe	162
16428	21620	WerFault.exe	144
5804	17000	WerFault.exe	146
44148	13400	WerFault.exe	158
5640	16980	WerFault.exe	202
6996	21188	WerFault.exe	156

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4PMUTPPioaCbt58w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mjht38a6WnZUtcaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n4qZLjavj8B7MVkz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3684d0c688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x6opM3zTxMt4QLhD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7c7NOntXr6v59Ee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	492e27e0fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tfH30BxtW8vGHtxp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VTQYPRyI307E6zKH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yG9cBocNRmSCwkmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mrCtcGEomQ1xOptZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f91a0abc2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lEJgEOZCSS6gV9iZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VLuQ4DCE3XbQtbss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96O1xkJRqCx7hGFk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94CwbGg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o6atSNdeVvoRfGID.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ob33kTQ5LtLBxeUm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	onRu0iv8LGeKyR4a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qb0di4UL4O75N269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tetVHVFfIravIUS6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KQzy6fynoN1DjdDl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blnUILwlcguqnE0C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q7ubF14M1ceQwXWo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QMYbb3uPvnAdSdro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Z0t5xwD9fjbqBVtJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KTE7rMysjBwnKGtl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	piCa5b1fferJ9gm3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H9TU4oY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXnySNbOjuH7FYqb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	O2wNY3JiAvfFdiKO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	W04Ma2o8hJ2qDk13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HSagHvzrubDuPr7G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhjmZUKn1udx4nd4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zcKwNJmVonlz9iXs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IFWfgUeuDRbtUpqA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DWDPbCeweYc11LwQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOD2qH8mCbS4oMNi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72MwGBiwOLThqT2s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FvrxD1t0NgnacVGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oLzuj5YkDiUr4GoZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	596166adff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dOkvofIvwQLj5mfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qQfpMQ7M8pM59WoZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9n2egXzGV2Ko9etY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hY3hWqmdTbuOdyOK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QeoOFLXB1dzqos78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bQk5aoVdBPLlnLQ0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PLainWkRTD33uIEh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ioPrEmy2XqNArQiV.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x1vSyxJyc9IA28sv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZNkHrdwwxDVJeBS8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1MJ3OAKVCFCqm2Os.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SurnWrPmoqP4Cgsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NwuvpzTIJkRYEV9B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iTjZR6J8FvZGopFg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iDAmp2zc9Vwz6PZE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShtrayEasy35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gwp3uvtZjr2WgZSj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da3b2817bc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
11196	PING.EXE
28292	powershell.exe
20524	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a55332af62.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a55332af62.exe

Kills process with taskkill 1 IoCs

pid	Process
37928	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	a55332af62.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	a55332af62.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	a55332af62.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
11196	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
10788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
2716	skotes.exe
1532	H9TU4oY.exe
1532	H9TU4oY.exe
1532	H9TU4oY.exe
1532	H9TU4oY.exe
1532	H9TU4oY.exe
2452	ShtrayEasy35.exe
1692	FvrxD1t0NgnacVGo.exe
2160	QeoOFLXB1dzqos78.exe
2160	QeoOFLXB1dzqos78.exe
2160	QeoOFLXB1dzqos78.exe
1812	VHGLBZ9EUPwJbzBM.exe
1812	VHGLBZ9EUPwJbzBM.exe
1812	VHGLBZ9EUPwJbzBM.exe
1812	VHGLBZ9EUPwJbzBM.exe
2096	BXnySNbOjuH7FYqb.exe
2096	BXnySNbOjuH7FYqb.exe
2096	BXnySNbOjuH7FYqb.exe
2096	BXnySNbOjuH7FYqb.exe
2096	BXnySNbOjuH7FYqb.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
2284	qcMYfA4dVWqCLkO2.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
1512	tfH30BxtW8vGHtxp.exe
2284	qcMYfA4dVWqCLkO2.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
2276	Gwp3uvtZjr2WgZSj.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
552	Y68QAGrjnXc9vNUt.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe
1036	jBNWEI1cyqjjpO2S.exe
552	Y68QAGrjnXc9vNUt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	94CwbGg.exe
Token: SeShutdownPrivilege	2944	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2944	msiexec.exe
Token: SeRestorePrivilege	2036	msiexec.exe
Token: SeTakeOwnershipPrivilege	2036	msiexec.exe
Token: SeSecurityPrivilege	2036	msiexec.exe
Token: SeCreateTokenPrivilege	2944	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2944	msiexec.exe
Token: SeLockMemoryPrivilege	2944	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2944	msiexec.exe
Token: SeMachineAccountPrivilege	2944	msiexec.exe
Token: SeTcbPrivilege	2944	msiexec.exe
Token: SeSecurityPrivilege	2944	msiexec.exe
Token: SeTakeOwnershipPrivilege	2944	msiexec.exe
Token: SeLoadDriverPrivilege	2944	msiexec.exe
Token: SeSystemProfilePrivilege	2944	msiexec.exe
Token: SeSystemtimePrivilege	2944	msiexec.exe
Token: SeProfSingleProcessPrivilege	2944	msiexec.exe
Token: SeIncBasePriorityPrivilege	2944	msiexec.exe
Token: SeCreatePagefilePrivilege	2944	msiexec.exe
Token: SeCreatePermanentPrivilege	2944	msiexec.exe
Token: SeBackupPrivilege	2944	msiexec.exe
Token: SeRestorePrivilege	2944	msiexec.exe
Token: SeShutdownPrivilege	2944	msiexec.exe
Token: SeDebugPrivilege	2944	msiexec.exe
Token: SeAuditPrivilege	2944	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2944	msiexec.exe
Token: SeChangeNotifyPrivilege	2944	msiexec.exe
Token: SeRemoteShutdownPrivilege	2944	msiexec.exe
Token: SeUndockPrivilege	2944	msiexec.exe
Token: SeSyncAgentPrivilege	2944	msiexec.exe
Token: SeEnableDelegationPrivilege	2944	msiexec.exe
Token: SeManageVolumePrivilege	2944	msiexec.exe
Token: SeImpersonatePrivilege	2944	msiexec.exe
Token: SeCreateGlobalPrivilege	2944	msiexec.exe
Token: SeCreateTokenPrivilege	2944	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2944	msiexec.exe
Token: SeLockMemoryPrivilege	2944	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2944	msiexec.exe
Token: SeMachineAccountPrivilege	2944	msiexec.exe
Token: SeTcbPrivilege	2944	msiexec.exe
Token: SeSecurityPrivilege	2944	msiexec.exe
Token: SeTakeOwnershipPrivilege	2944	msiexec.exe
Token: SeLoadDriverPrivilege	2944	msiexec.exe
Token: SeSystemProfilePrivilege	2944	msiexec.exe
Token: SeSystemtimePrivilege	2944	msiexec.exe
Token: SeProfSingleProcessPrivilege	2944	msiexec.exe
Token: SeIncBasePriorityPrivilege	2944	msiexec.exe
Token: SeCreatePagefilePrivilege	2944	msiexec.exe
Token: SeCreatePermanentPrivilege	2944	msiexec.exe
Token: SeBackupPrivilege	2944	msiexec.exe
Token: SeRestorePrivilege	2944	msiexec.exe
Token: SeShutdownPrivilege	2944	msiexec.exe
Token: SeDebugPrivilege	2944	msiexec.exe
Token: SeAuditPrivilege	2944	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2944	msiexec.exe
Token: SeChangeNotifyPrivilege	2944	msiexec.exe
Token: SeRemoteShutdownPrivilege	2944	msiexec.exe
Token: SeUndockPrivilege	2944	msiexec.exe
Token: SeSyncAgentPrivilege	2944	msiexec.exe
Token: SeEnableDelegationPrivilege	2944	msiexec.exe
Token: SeManageVolumePrivilege	2944	msiexec.exe
Token: SeImpersonatePrivilege	2944	msiexec.exe
Token: SeCreateGlobalPrivilege	2944	msiexec.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
2944	msiexec.exe
2944	msiexec.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe
17220	596166adff.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2716	2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe	30
PID 2480 wrote to memory of 2716	2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe	30
PID 2480 wrote to memory of 2716	2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe	30
PID 2480 wrote to memory of 2716	2480	71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe	30
PID 2716 wrote to memory of 3008	2716	skotes.exe	33
PID 2716 wrote to memory of 3008	2716	skotes.exe	33
PID 2716 wrote to memory of 3008	2716	skotes.exe	33
PID 2716 wrote to memory of 3008	2716	skotes.exe	33
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 3008 wrote to memory of 2944	3008	94CwbGg.exe	34
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 2036 wrote to memory of 3020	2036	msiexec.exe	36
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 3020 wrote to memory of 1564	3020	MsiExec.exe	37
PID 2036 wrote to memory of 1040	2036	msiexec.exe	40
PID 2036 wrote to memory of 1040	2036	msiexec.exe	40
PID 2036 wrote to memory of 1040	2036	msiexec.exe	40
PID 2716 wrote to memory of 1532	2716	skotes.exe	41
PID 2716 wrote to memory of 1532	2716	skotes.exe	41
PID 2716 wrote to memory of 1532	2716	skotes.exe	41
PID 2716 wrote to memory of 1532	2716	skotes.exe	41
PID 2716 wrote to memory of 2452	2716	skotes.exe	43
PID 2716 wrote to memory of 2452	2716	skotes.exe	43
PID 2716 wrote to memory of 2452	2716	skotes.exe	43
PID 2716 wrote to memory of 2452	2716	skotes.exe	43
PID 2452 wrote to memory of 1692	2452	ShtrayEasy35.exe	44
PID 2452 wrote to memory of 1692	2452	ShtrayEasy35.exe	44
PID 2452 wrote to memory of 1692	2452	ShtrayEasy35.exe	44
PID 2452 wrote to memory of 1692	2452	ShtrayEasy35.exe	44
PID 2452 wrote to memory of 2160	2452	ShtrayEasy35.exe	45
PID 2452 wrote to memory of 2160	2452	ShtrayEasy35.exe	45
PID 2452 wrote to memory of 2160	2452	ShtrayEasy35.exe	45
PID 2452 wrote to memory of 2160	2452	ShtrayEasy35.exe	45
PID 2452 wrote to memory of 1812	2452	ShtrayEasy35.exe	46
PID 2452 wrote to memory of 1812	2452	ShtrayEasy35.exe	46
PID 2452 wrote to memory of 1812	2452	ShtrayEasy35.exe	46
PID 2452 wrote to memory of 1812	2452	ShtrayEasy35.exe	46
PID 2452 wrote to memory of 2096	2452	ShtrayEasy35.exe	47
PID 2452 wrote to memory of 2096	2452	ShtrayEasy35.exe	47
PID 2452 wrote to memory of 2096	2452	ShtrayEasy35.exe	47
PID 2452 wrote to memory of 2096	2452	ShtrayEasy35.exe	47
PID 2452 wrote to memory of 2276	2452	ShtrayEasy35.exe	48
PID 2452 wrote to memory of 2276	2452	ShtrayEasy35.exe	48
PID 2452 wrote to memory of 2276	2452	ShtrayEasy35.exe	48
PID 2452 wrote to memory of 2276	2452	ShtrayEasy35.exe	48
PID 2452 wrote to memory of 2284	2452	ShtrayEasy35.exe	49
PID 2452 wrote to memory of 2284	2452	ShtrayEasy35.exe	49
PID 2452 wrote to memory of 2284	2452	ShtrayEasy35.exe	49
PID 2452 wrote to memory of 2284	2452	ShtrayEasy35.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

Hidden Files and Directories

T1564.001

pid	Process
20256	attrib.exe
12712	attrib.exe
20340	attrib.exe

C:\Users\Admin\AppData\Local\Temp\71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe
"C:\Users\Admin\AppData\Local\Temp\71da7d1635f8d6162009ae77943109bf19b0ff32de0e12b4e6079901fd750b8e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Local\Temp\1015305001\94CwbGg.exe
    "C:\Users\Admin\AppData\Local\Temp\1015305001\94CwbGg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\eecac53463291819\ScreenConnect.ClientSetup.msi"
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2944
- - C:\Users\Admin\AppData\Local\Temp\1015327001\H9TU4oY.exe
    "C:\Users\Admin\AppData\Local\Temp\1015327001\H9TU4oY.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\1015564001\ShtrayEasy35.exe
    "C:\Users\Admin\AppData\Local\Temp\1015564001\ShtrayEasy35.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\uW4uel75\FvrxD1t0NgnacVGo.exe
      C:\Users\Admin\AppData\Local\Temp\uW4uel75\FvrxD1t0NgnacVGo.exe 2452
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1692
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 600
        5⤵
        Program crash
        
        PID:20796
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\QeoOFLXB1dzqos78.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\QeoOFLXB1dzqos78.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2160
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 212
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\VHGLBZ9EUPwJbzBM.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\VHGLBZ9EUPwJbzBM.exe 2452
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 220
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\BXnySNbOjuH7FYqb.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\BXnySNbOjuH7FYqb.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2096
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 264
        5⤵
        Program crash
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Gwp3uvtZjr2WgZSj.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Gwp3uvtZjr2WgZSj.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 240
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\qcMYfA4dVWqCLkO2.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\qcMYfA4dVWqCLkO2.exe 2452
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 248
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\1MJ3OAKVCFCqm2Os.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\1MJ3OAKVCFCqm2Os.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 232
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\tfH30BxtW8vGHtxp.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\tfH30BxtW8vGHtxp.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 248
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:13524
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\jBNWEI1cyqjjpO2S.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\jBNWEI1cyqjjpO2S.exe 2452
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 260
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Y68QAGrjnXc9vNUt.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Y68QAGrjnXc9vNUt.exe 2452
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 268
        5⤵
        Program crash
        
        PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\m3zpmORN4GRJcldI.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\m3zpmORN4GRJcldI.exe 2452
      4⤵
      Executes dropped EXE
      PID:13540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13540 -s 264
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\OhiiOCcga3BO9uMg.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\OhiiOCcga3BO9uMg.exe 2452
      4⤵
      Executes dropped EXE
      PID:13572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13572 -s 252
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\MNdirSTaa4p8SC4h.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\MNdirSTaa4p8SC4h.exe 2452
      4⤵
      Executes dropped EXE
      PID:13604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13604 -s 260
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:21676
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Mjht38a6WnZUtcaq.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Mjht38a6WnZUtcaq.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:15468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15468 -s 248
        5⤵
        Program crash
        
        PID:20300
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\oLzuj5YkDiUr4GoZ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\oLzuj5YkDiUr4GoZ.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:20376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20376 -s 256
        5⤵
        Program crash
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\xqx9MLDJbezTZyED.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\xqx9MLDJbezTZyED.exe 2452
      4⤵
      Executes dropped EXE
      PID:16676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16676 -s 244
        5⤵
        Program crash
        
        PID:21632
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\rIbegFnfAtQ82pOn.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\rIbegFnfAtQ82pOn.exe 2452
      4⤵
      Executes dropped EXE
      PID:16728
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16728 -s 260
        5⤵
        Program crash
        
        PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\cSvhasBz9tzErqfc.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\cSvhasBz9tzErqfc.exe 2452
      4⤵
      Executes dropped EXE
      PID:13288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13288 -s 252
        5⤵
        Program crash
        
        PID:20672
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\mrCtcGEomQ1xOptZ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\mrCtcGEomQ1xOptZ.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:15036
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15036 -s 276
        5⤵
        Program crash
        
        PID:13152
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\O2wNY3JiAvfFdiKO.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\O2wNY3JiAvfFdiKO.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:21196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21196 -s 280
        5⤵
        Program crash
        
        PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\xv7D8njCc0CvJZmX.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\xv7D8njCc0CvJZmX.exe 2452
      4⤵
      Executes dropped EXE
      PID:21364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21364 -s 264
        5⤵
        Program crash
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\n4qZLjavj8B7MVkz.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\n4qZLjavj8B7MVkz.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:21540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21540 -s 292
        5⤵
        Program crash
        
        PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\9n2egXzGV2Ko9etY.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\9n2egXzGV2Ko9etY.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:22016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22016 -s 264
        5⤵
        Program crash
        
        PID:23096
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\zdt58slRKIa24RlE.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\zdt58slRKIa24RlE.exe 2452
      4⤵
      Executes dropped EXE
      PID:22080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22080 -s 240
        5⤵
        Program crash
        
        PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\bQk5aoVdBPLlnLQ0.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\bQk5aoVdBPLlnLQ0.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:22384
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22384 -s 272
        5⤵
        Program crash
        
        PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\rIJdZ8vYj5g9Ju64.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\rIJdZ8vYj5g9Ju64.exe 2452
      4⤵
      Executes dropped EXE
      PID:4072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 280
        5⤵
        Program crash
        
        PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Px9Y96ETeHz1kv8q.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Px9Y96ETeHz1kv8q.exe 2452
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 168
        5⤵
        Program crash
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\PLainWkRTD33uIEh.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\PLainWkRTD33uIEh.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 280
        5⤵
        Program crash
        
        PID:27196
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\blnUILwlcguqnE0C.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\blnUILwlcguqnE0C.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:9560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9560 -s 168
        5⤵
        Program crash
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\sid1h3y10Z5latjY.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\sid1h3y10Z5latjY.exe 2452
      4⤵
      Executes dropped EXE
      PID:10128
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10128 -s 300
        5⤵
        Program crash
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\q2IGBmrrlk6mkw4D.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\q2IGBmrrlk6mkw4D.exe 2452
      4⤵
      Executes dropped EXE
      PID:10004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10004 -s 276
        5⤵
        Program crash
        
        PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\1xCkrZR2ihgx9jyX.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\1xCkrZR2ihgx9jyX.exe 2452
      4⤵
      Executes dropped EXE
      PID:21816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21816 -s 288
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\u78FsTSyWjK5HVni.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\u78FsTSyWjK5HVni.exe 2452
      4⤵
      Executes dropped EXE
      PID:7208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 284
        5⤵
        Program crash
        
        PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\FKc86Qa8Mx9Qlz0A.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\FKc86Qa8Mx9Qlz0A.exe 2452
      4⤵
      Executes dropped EXE
      PID:12484
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12484 -s 280
        5⤵
        Program crash
        
        PID:27540
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\hY3hWqmdTbuOdyOK.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\hY3hWqmdTbuOdyOK.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1804
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 272
        5⤵
        Program crash
        
        PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\7ID9ZeTs209m8hr2.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\7ID9ZeTs209m8hr2.exe 2452
      4⤵
      Executes dropped EXE
      PID:13148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13148 -s 272
        5⤵
        Program crash
        
        PID:27100
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\uqgpnpYNAadwKV9S.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\uqgpnpYNAadwKV9S.exe 2452
      4⤵
      Executes dropped EXE
      PID:12832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12832 -s 284
        5⤵
        Program crash
        
        PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\SurnWrPmoqP4Cgsh.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\SurnWrPmoqP4Cgsh.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:13192
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13192 -s 296
        5⤵
        Program crash
        
        PID:20884
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\o6atSNdeVvoRfGID.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\o6atSNdeVvoRfGID.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 292
        5⤵
        Program crash
        
        PID:19776
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\VTQYPRyI307E6zKH.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\VTQYPRyI307E6zKH.exe 2452
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:12088
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12088 -s 288
        5⤵
        Program crash
        
        PID:4304
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\7qFju6o2mNBuTGHs.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\7qFju6o2mNBuTGHs.exe 2452
      4⤵
      Executes dropped EXE
      PID:12108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12108 -s 292
        5⤵
        Program crash
        
        PID:20156
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\72MwGBiwOLThqT2s.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\72MwGBiwOLThqT2s.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:21620
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21620 -s 328
        5⤵
        Program crash
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\ePvz6iEwWunVtugZ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\ePvz6iEwWunVtugZ.exe 2452
      4⤵
      PID:344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 304
        5⤵
        Program crash
        
        PID:19396
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Hk26PEfWqn9fGqhj.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Hk26PEfWqn9fGqhj.exe 2452
      4⤵
      PID:17000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17000 -s 324
        5⤵
        Program crash
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\qQfpMQ7M8pM59WoZ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\qQfpMQ7M8pM59WoZ.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:13608
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13608 -s 304
        5⤵
        Program crash
        
        PID:39772
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\iDAmp2zc9Vwz6PZE.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\iDAmp2zc9Vwz6PZE.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:22000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22000 -s 312
        5⤵
        Program crash
        
        PID:39576
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\B2t5V16RkDYgah1w.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\B2t5V16RkDYgah1w.exe 2452
      4⤵
      PID:27208
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 27208 -s 308
        5⤵
        Program crash
        
        PID:46820
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\XA4HXJYdBmqUCojL.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\XA4HXJYdBmqUCojL.exe 2452
      4⤵
      PID:23460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23460 -s 344
        5⤵
        Program crash
        
        PID:38864
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\iIrgWNZwHXawVInf.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\iIrgWNZwHXawVInf.exe 2452
      4⤵
      PID:23508
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23508 -s 328
        5⤵
        Program crash
        
        PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\bZEAZZGKGbqnhwv0.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\bZEAZZGKGbqnhwv0.exe 2452
      4⤵
      PID:21188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21188 -s 348
        5⤵
        Program crash
        
        PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\IIgfdP7KQ48p1b6x.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\IIgfdP7KQ48p1b6x.exe 2452
      4⤵
      PID:6616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6616 -s 324
        5⤵
        Program crash
        
        PID:46532
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\TuBgYfGJCIXTIYfq.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\TuBgYfGJCIXTIYfq.exe 2452
      4⤵
      PID:13400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13400 -s 352
        5⤵
        Program crash
        
        PID:44148
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Qb0di4UL4O75N269.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Qb0di4UL4O75N269.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:17904
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17904 -s 316
        5⤵
        
        PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\fhjmZUKn1udx4nd4.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\fhjmZUKn1udx4nd4.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:21520
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21520 -s 340
        5⤵
        Program crash
        
        PID:27192
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\tetVHVFfIravIUS6.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\tetVHVFfIravIUS6.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:20680
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20680 -s 364
        5⤵
        
        PID:37352
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\QMYbb3uPvnAdSdro.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\QMYbb3uPvnAdSdro.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:19576
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19576 -s 352
        5⤵
        Program crash
        
        PID:32080
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\lSzkcht5GxKxFFYS.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\lSzkcht5GxKxFFYS.exe 2452
      4⤵
      PID:20724
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20724 -s 332
        5⤵
        Program crash
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\q7ubF14M1ceQwXWo.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\q7ubF14M1ceQwXWo.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:20344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20344 -s 168
        5⤵
        Program crash
        
        PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\D3EMZIn0tijyxuCc.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\D3EMZIn0tijyxuCc.exe 2452
      4⤵
      PID:17632
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17632 -s 168
        5⤵
        Program crash
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\HSagHvzrubDuPr7G.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\HSagHvzrubDuPr7G.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:19664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19664 -s 168
        5⤵
        Program crash
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\BkQUaqKYmVYaDaOf.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\BkQUaqKYmVYaDaOf.exe 2452
      4⤵
      PID:19400
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19400 -s 168
        5⤵
        Program crash
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\yG9cBocNRmSCwkmb.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\yG9cBocNRmSCwkmb.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:12376
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12376 -s 168
        5⤵
        Program crash
        
        PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\flxe8eSmVfjlqvkz.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\flxe8eSmVfjlqvkz.exe 2452
      4⤵
      PID:20240
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20240 -s 168
        5⤵
        Program crash
        
        PID:21200
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\86bdsBES9M5rGNdb.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\86bdsBES9M5rGNdb.exe 2452
      4⤵
      PID:4060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 168
        5⤵
        Program crash
        
        PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\axCZMCSmNQ0H9Ez0.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\axCZMCSmNQ0H9Ez0.exe 2452
      4⤵
      PID:9380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9380 -s 168
        5⤵
        Program crash
        
        PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\dOkvofIvwQLj5mfd.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\dOkvofIvwQLj5mfd.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:12768
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12768 -s 168
        5⤵
        Program crash
        
        PID:21176
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\l56r1prSkoVZwHrR.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\l56r1prSkoVZwHrR.exe 2452
      4⤵
      PID:16980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16980 -s 388
        5⤵
        Program crash
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\ioPrEmy2XqNArQiV.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\ioPrEmy2XqNArQiV.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:11360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11360 -s 396
        5⤵
        
        PID:37200
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\x6opM3zTxMt4QLhD.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\x6opM3zTxMt4QLhD.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:9168
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9168 -s 376
        5⤵
        
        PID:37764
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\cPdhaHJbk53rR3jG.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\cPdhaHJbk53rR3jG.exe 2452
      4⤵
      PID:31900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 31900 -s 372
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\rcxqoJjuTOhR1A0l.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\rcxqoJjuTOhR1A0l.exe 2452
      4⤵
      PID:31924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 31924 -s 388
        5⤵
        
        PID:41976
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\zcKwNJmVonlz9iXs.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\zcKwNJmVonlz9iXs.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:32076
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32076 -s 2560
        5⤵
        
        PID:35604
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\ob33kTQ5LtLBxeUm.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\ob33kTQ5LtLBxeUm.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:46420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 46420 -s 392
        5⤵
        
        PID:26960
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\fr67bhkfHJhiqEUd.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\fr67bhkfHJhiqEUd.exe 2452
      4⤵
      PID:16268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16268 -s 404
        5⤵
        
        PID:21972
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\KQzy6fynoN1DjdDl.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\KQzy6fynoN1DjdDl.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:47004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 47004 -s 404
        5⤵
        
        PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\1dOfz6MY4X0Za1hB.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\1dOfz6MY4X0Za1hB.exe 2452
      4⤵
      PID:18996
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18996 -s 408
        5⤵
        
        PID:19980
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\W04Ma2o8hJ2qDk13.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\W04Ma2o8hJ2qDk13.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:7856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7856 -s 396
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\ZNkHrdwwxDVJeBS8.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\ZNkHrdwwxDVJeBS8.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:23004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23004 -s 444
        5⤵
        
        PID:48004
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Op06Brfag9dYtbKX.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Op06Brfag9dYtbKX.exe 2452
      4⤵
      PID:31052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 31052 -s 384
        5⤵
        
        PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\onRu0iv8LGeKyR4a.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\onRu0iv8LGeKyR4a.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:42912
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 42912 -s 396
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\NwuvpzTIJkRYEV9B.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\NwuvpzTIJkRYEV9B.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:38884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38884 -s 396
        5⤵
        
        PID:40052
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\iTjZR6J8FvZGopFg.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\iTjZR6J8FvZGopFg.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:38924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38924 -s 404
        5⤵
        
        PID:38216
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\oKhWy3RMGyIGPMPU.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\oKhWy3RMGyIGPMPU.exe 2452
      4⤵
      PID:31148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 31148 -s 432
        5⤵
        
        PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\x1vSyxJyc9IA28sv.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\x1vSyxJyc9IA28sv.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:24224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 24224 -s 424
        5⤵
        
        PID:20284
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\Z0t5xwD9fjbqBVtJ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\Z0t5xwD9fjbqBVtJ.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:20876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20876 -s 396
        5⤵
        
        PID:20212
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\KTE7rMysjBwnKGtl.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\KTE7rMysjBwnKGtl.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:21220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21220 -s 416
        5⤵
        
        PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\DWDPbCeweYc11LwQ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\DWDPbCeweYc11LwQ.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:19220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19220 -s 420
        5⤵
        
        PID:13724
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\lEJgEOZCSS6gV9iZ.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\lEJgEOZCSS6gV9iZ.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:8140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8140 -s 448
        5⤵
        
        PID:28344
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\IFWfgUeuDRbtUpqA.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\IFWfgUeuDRbtUpqA.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:35672
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 35672 -s 152
        5⤵
        
        PID:24544
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\piCa5b1fferJ9gm3.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\piCa5b1fferJ9gm3.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:13924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13924 -s 428
        5⤵
        
        PID:43244
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\KsRPatLPQBgKSc8U.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\KsRPatLPQBgKSc8U.exe 2452
      4⤵
      PID:21012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21012 -s 468
        5⤵
        
        PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\glDrR7KlOE1Gr3y2.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\glDrR7KlOE1Gr3y2.exe 2452
      4⤵
      PID:37424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 37424 -s 420
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\lHdfY8CFAVvgWpQi.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\lHdfY8CFAVvgWpQi.exe 2452
      4⤵
      PID:26752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26752 -s 420
        5⤵
        
        PID:10716
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\O4dZV3RJOFhPzpFv.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\O4dZV3RJOFhPzpFv.exe 2452
      4⤵
      PID:13528
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13528 -s 432
        5⤵
        
        PID:48484
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\nVj5gJTltzobWpZs.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\nVj5gJTltzobWpZs.exe 2452
      4⤵
      PID:7156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 460
        5⤵
        
        PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\b7c7NOntXr6v59Ee.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\b7c7NOntXr6v59Ee.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:28524
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 28524 -s 456
        5⤵
        
        PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\T8jkqKGjh8fP6yxC.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\T8jkqKGjh8fP6yxC.exe 2452
      4⤵
      PID:4792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 464
        5⤵
        
        PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\96O1xkJRqCx7hGFk.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\96O1xkJRqCx7hGFk.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:8204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8204 -s 460
        5⤵
        
        PID:49052
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\VLuQ4DCE3XbQtbss.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\VLuQ4DCE3XbQtbss.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:46984
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 46984 -s 452
        5⤵
        
        PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\SOD2qH8mCbS4oMNi.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\SOD2qH8mCbS4oMNi.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:26828
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26828 -s 460
        5⤵
        
        PID:23388
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\32mGcveBmZuCjbHU.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\32mGcveBmZuCjbHU.exe 2452
      4⤵
      PID:21856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21856 -s 496
        5⤵
        
        PID:22408
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\WkTHCBCQ2xKxf6q3.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\WkTHCBCQ2xKxf6q3.exe 2452
      4⤵
      PID:30000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30000 -s 492
        5⤵
        
        PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\4PMUTPPioaCbt58w.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\4PMUTPPioaCbt58w.exe 2452
      4⤵
      System Location Discovery: System Language Discovery
      PID:29840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 29840 -s 476
        5⤵
        
        PID:33472
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\XwhgttbUMsQCrsxF.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\XwhgttbUMsQCrsxF.exe 2452
      4⤵
      PID:15532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15532 -s 500
        5⤵
        
        PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\GtDKgBlfaSaGrDWq.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\GtDKgBlfaSaGrDWq.exe 2452
      4⤵
      PID:29820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 29820 -s 480
        5⤵
        
        PID:30024
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\tijSTvmTrkq2CS2c.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\tijSTvmTrkq2CS2c.exe 2452
      4⤵
      PID:22764
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22764 -s 480
        5⤵
        
        PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\RxS97bKjrMmUkboL.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\RxS97bKjrMmUkboL.exe 2452
      4⤵
      PID:30040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30040 -s 488
        5⤵
        
        PID:19124
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\JUjbIeJirajXzXp2.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\JUjbIeJirajXzXp2.exe 2452
      4⤵
      PID:37868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 37868 -s 504
        5⤵
        
        PID:26788
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\kwEEUPKQ6bJSYtIW.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\kwEEUPKQ6bJSYtIW.exe 2452
      4⤵
      PID:27860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 27860 -s 492
        5⤵
        
        PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\1Vl0sppA7GnIIL2k.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\1Vl0sppA7GnIIL2k.exe 2452
      4⤵
      PID:21344
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21344 -s 484
        5⤵
        
        PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\zFwgIEkWKe62b778.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\zFwgIEkWKe62b778.exe 2452
      4⤵
      PID:32752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32752 -s 492
        5⤵
        
        PID:42408
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\DpxUGV0SSf6ihAWX.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\DpxUGV0SSf6ihAWX.exe 2452
      4⤵
      PID:35524
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\A79pM3LUVBLpACLn.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\A79pM3LUVBLpACLn.exe 2452
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\NO4aPi70P9vbb9GI.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\NO4aPi70P9vbb9GI.exe 2452
      4⤵
      PID:24456
  - - C:\Users\Admin\AppData\Local\Temp\1015564001\gHqIei8O2MmI4tBt.exe
      C:\Users\Admin\AppData\Local\Temp\1015564001\gHqIei8O2MmI4tBt.exe 2452
      4⤵
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\1015594001\492e27e0fc.exe
    "C:\Users\Admin\AppData\Local\Temp\1015594001\492e27e0fc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7248
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:15756
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:20332
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        
        PID:20344
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:22524
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:8480
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        
        PID:21048
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:20132
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:20256
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:20340
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10788
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:20524
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:11196
- - C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe
    "C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe"
      4⤵
      Executes dropped EXE
      PID:20404
  - - C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe"
      4⤵
      Executes dropped EXE
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1015595001\da3b2817bc.exe"
      4⤵
      Executes dropped EXE
      PID:9008
- - C:\Users\Admin\AppData\Local\Temp\1015596001\a55332af62.exe
    "C:\Users\Admin\AppData\Local\Temp\1015596001\a55332af62.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Modifies system certificate store
    PID:7080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015596001\a55332af62.exe" & rd /s /q "C:\ProgramData\KXBA1VAI58YM" & exit
      4⤵
      PID:3276
- - C:\Users\Admin\AppData\Local\Temp\1015597001\58da931bf9.exe
    "C:\Users\Admin\AppData\Local\Temp\1015597001\58da931bf9.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\LQSS34GMH5633Q49XGT5N7PKCEZOK.exe
      "C:\Users\Admin\AppData\Local\Temp\LQSS34GMH5633Q49XGT5N7PKCEZOK.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Identifies Wine through registry keys
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe
      "C:\Users\Admin\AppData\Local\Temp\9PABLS66O3T6A5KME4ITMXUZG0Z0I.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:37736
- - C:\Users\Admin\AppData\Local\Temp\1015598001\3684d0c688.exe
    "C:\Users\Admin\AppData\Local\Temp\1015598001\3684d0c688.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:16228
- - C:\Users\Admin\AppData\Local\Temp\1015599001\596166adff.exe
    "C:\Users\Admin\AppData\Local\Temp\1015599001\596166adff.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:17220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:37928
- - C:\Users\Admin\AppData\Local\Temp\1015600001\f91a0abc2c.exe
    "C:\Users\Admin\AppData\Local\Temp\1015600001\f91a0abc2c.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Windows security modification
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:12072
- - C:\Users\Admin\AppData\Local\Temp\1015601001\a7742b4376.exe
    "C:\Users\Admin\AppData\Local\Temp\1015601001\a7742b4376.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:21580

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24DF8E151B24815EE9F40EADA1B6596C C
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF2F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259453842 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    PID:1564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 864
  2⤵
  PID:1040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:960

C:\Windows\system32\taskeng.exe
taskeng.exe {3F481A92-13B6-45F0-A2DE-3E6B82B8CA06} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
PID:42828
- C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
  2⤵
  PID:23168
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    PID:37240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:28292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:11132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion